diff --git a/debian.control b/debian.control
index 1a64a01..2e8e3f5 100644
--- a/debian.control
+++ b/debian.control
@@ -7,7 +7,14 @@ Standards-Version: 4.5.0
 Package: system-user-gromox
 Architecture: all
 Pre-Depends: ${misc:Pre-Depends}
+Provides: system-group-gromox, system-group-gromoxcf
 Depends: adduser, ${misc:Depends}
 Description: System user and group gromox
  .
- This package provides the gromox account.
+ This package provides:
+ * the "gromox" user identity for running Gromox services as
+ * the "gromox" group identity for marking data to be consumed by Gromox
+   services but possibly created by AAPI, e.g. mailbox contents
+ * the "gromoxcf" group identity for marking (possibly sensitive)
+   configuration, to be consumed by Gromox services and select
+   services (like saslauthd/keycloak dlopening pam_gromox.so)
diff --git a/debian.rules b/debian.rules
index 953462f..1f0fbb5 100644
--- a/debian.rules
+++ b/debian.rules
@@ -1,3 +1,11 @@
 #!/usr/bin/make -f
 %:
 	dh $@ --parallel
+sudir = usr/lib/sysusers.d
+sufile = ${sudir}/system-user-gromox.conf
+override_dh_auto_install:
+	mkdir -p ${sudir}
+	echo 'g gromox -' >${sufile}
+	echo 'g gromoxcf -' >>${sufile}
+	echo 'u gromox - "Gromox services"' >>${sufile}
+	echo 'm gromox gromoxcf' >>${sufile}
diff --git a/debian.system-user-gromox.install b/debian.system-user-gromox.install
index 473a0f4..2e6dbc0 100644
--- a/debian.system-user-gromox.install
+++ b/debian.system-user-gromox.install
@@ -0,0 +1 @@
+usr/
diff --git a/debian.system-user-gromox.postinst b/debian.system-user-gromox.postinst
index 0cbf6d4..eed5fa2 100644
--- a/debian.system-user-gromox.postinst
+++ b/debian.system-user-gromox.postinst
@@ -1,6 +1,14 @@
 #!/bin/sh
-getent group gromox >/dev/null || addgroup --system gromox
-getent group gromoxcf >/dev/null || addgroup --system gromoxcf
-getent passwd gromox >/dev/null || \
-	adduser --system gromox --home /var/lib/gromox --no-create-home --disabled-password --ingroup gromox
-usermod gromox -aG gromoxcf
+case "$1" in
+configure|reconfigure)
+	if [ -x /usr/bin/systemd-sysusers ]; then
+		/usr/bin/systemd-sysusers system-user-gromox.conf
+	else
+		getent group gromox >/dev/null || addgroup --system gromox
+		getent group gromoxcf >/dev/null || addgroup --system gromoxcf
+		getent passwd gromox >/dev/null || \
+			adduser --system gromox --home /var/lib/gromox --no-create-home --disabled-password --ingroup gromox
+		usermod gromox -aG gromoxcf
+	fi
+	;;
+esac
diff --git a/dummy_for_debtransform.tgz b/dummy_for_debtransform.tgz
new file mode 100644
index 0000000..22632ba
--- /dev/null
+++ b/dummy_for_debtransform.tgz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:fd211e6cbb3d0d7d6fe7c8c8389bb5d269df09692848663626636930e4246892
+size 231
diff --git a/system-user-gromox.changes b/system-user-gromox.changes
index 200a45a..e66a6ba 100644
--- a/system-user-gromox.changes
+++ b/system-user-gromox.changes
@@ -1,3 +1,15 @@
+-------------------------------------------------------------------
+Wed Sep  4 19:28:11 UTC 2024 - Jan Engelhardt <jengelh@inai.de>
+
+- Update to release 9
+  * Switch to sysusers mechanism on Debian as well
+
+-------------------------------------------------------------------
+Tue Jun  4 08:06:05 UTC 2024 - Jan Engelhardt <jengelh@inai.de>
+
+- Update to release 7
+  * Added the "gromoxcf" group. Updated package descriptions.
+
 -------------------------------------------------------------------
 Thu Mar 14 21:30:34 UTC 2024 - Jan Engelhardt <jengelh@inai.de>
 
diff --git a/system-user-gromox.dsc b/system-user-gromox.dsc
index 61fdaf7..e716e56 100644
--- a/system-user-gromox.dsc
+++ b/system-user-gromox.dsc
@@ -1,7 +1,7 @@
 Format: 1.0
 Source: system-user-gromox
 Architecture: all
-Version: 5
+Version: 9
 Maintainer: Gromox <null@gromox.com>
 Homepage: https://grommunio.com
 Standards-Version: 3.9.4
diff --git a/system-user-gromox.spec b/system-user-gromox.spec
index a3fddfe..0cdbfe5 100644
--- a/system-user-gromox.spec
+++ b/system-user-gromox.spec
@@ -17,13 +17,14 @@
 
 
 Name:           system-user-gromox
-Version:        6
+Version:        9
 Release:        0
 Summary:        System user and group gromox
 License:        MIT
 Group:          System/Fhs
 URL:            https://grommunio.com/
 Source:         system-user-gromox.conf
+Source2:        dummy_for_debtransform.tgz
 BuildArch:      noarch
 BuildRequires:  systemd-rpm-macros
 %if 0%{?suse_version}
@@ -35,18 +36,20 @@ BuildRequires:  sysuser-tools
 %endif
 
 %description
-This package provides the gromox account.
+This package provides:
+* the "gromox" user identity for running Gromox services as
+* the "gromox" group identity for marking data to be consumed by Gromox
+  services but possibly created by AAPI, e.g. mailbox contents
+* the "gromoxcf" group identity for marking (possibly sensitive)
+  configuration, to be consumed by Gromox services and select
+  services (like saslauthd/keycloak dlopening pam_gromox.so)
 
 %prep
 
 %build
-# The conf file is provided by system-user-gromox rather than
-# gromox.spec so that e.g. grommunio-admin-api does not grow a
-# BuildRequire on gromox (wait times).
-#
 >user.pre
 %if 0%{?suse_version}
-%sysusers_generate_pre %_sourcedir/system-user-gromox.conf user
+%sysusers_generate_pre %_sourcedir/system-user-gromox.conf user system-user-gromox.conf
 %endif
 
 %install