diff --git a/tmpfiles.lastlog2.conf b/tmpfiles.lastlog2.conf
new file mode 100644
index 0000000..d6dce30
--- /dev/null
+++ b/tmpfiles.lastlog2.conf
@@ -0,0 +1,5 @@
+# This file is for lastlog2/pam_lastlog2.
+#
+# See tmpfiles.d(5) for details
+#
+d /var/lib/lastlog 0755 - - -
diff --git a/util-linux.changes b/util-linux.changes
index 16e4a8b..9781913 100644
--- a/util-linux.changes
+++ b/util-linux.changes
@@ -1,3 +1,11 @@
+-------------------------------------------------------------------
+Mon Apr  8 08:37:09 UTC 2024 - Thorsten Kukuk <kukuk@suse.com>
+
+- Add new lastlog2 sub-package (to solve migration problems due to
+  rpm %post/%postun ordering)
+  * Add pam-config calls to enable pam_lastlog2
+  * Add lastlog2.conf systemd-tmpfile to create database directory
+
 -------------------------------------------------------------------
 Sat Apr  6 19:53:02 UTC 2024 - Andreas Schwab <schwab@suse.de>
 
diff --git a/util-linux.spec b/util-linux.spec
index ac675ce..99e175e 100644
--- a/util-linux.spec
+++ b/util-linux.spec
@@ -102,6 +102,7 @@ Source13:       %{_name}.keyring
 Source14:       runuser.pamd
 Source15:       runuser-l.pamd
 Source16:       su-l.pamd
+Source17:       tmpfiles.lastlog2.conf
 Source51:       blkid.conf
 # PATCH-EXTEND-UPSTREAM: Let `su' handle /sbin and /usr/sbin in path
 Patch0:         make-sure-sbin-resp-usr-sbin-are-in-PATH.diff
@@ -153,9 +154,6 @@ Supplements:    (util-linux and systemd)
 Provides:       util-linux:/bin/logger
 # man pages were moved to -systemd subpackage with 2.38.x (SLE15 SP6, Leap 15.6)
 Conflicts:      util-linux < 2.38
-# lastlog2 got merged into util-linux 2.40
-Provides:       lastlog2 = %{version}-%{release}
-Obsoletes:      lastlog2 <= 1.3.1
 %systemd_requires
 %endif
 # ulsubset == systemd
@@ -371,6 +369,17 @@ unique IDs (UUIDs).
 # ulsubset == core
 
 %if "%ulsubset" == "systemd"
+
+%package -n lastlog2
+Summary:        Reports most recent login of users
+License:        BSD-2-Clause
+Group:          System/Base
+Requires(pre):  pam-config >= 2.4
+Requires(post): pam-config >= 2.4
+
+%description -n lastlog2
+pam_lastlog2 and lastlog2 are Y2038 safe versions of the old lastlog utility. pam_lastlog2 collects all data in a sqlite3 database and lastlog2 formats and prints the contents. The username, port, and last login time will be printed.
+
 %package -n liblastlog2-2
 Summary:        Library to report most recent login of users
 License:        BSD-2-Clause
@@ -643,6 +652,9 @@ mkdir -p %{buildroot}/run/uuidd
 # create it for uuidd. See boo#1206690.
 mkdir -p %{buildroot}%{_sharedstatedir}/libuuid/
 touch %{buildroot}%{_sharedstatedir}/libuuid/clock.txt
+# Install systemd-tmpfile for lastlog database
+mkdir -p %{buildroot}%{_tmpfilesdir}
+install -m 644 %{SOURCE17} %{buildroot}%{_tmpfilesdir}/lastlog2.conf
 %endif
 # ulsubset == systemd, ulbuild == base
 
@@ -845,6 +857,23 @@ done
 %postun
 %service_del_postun fstrim.service fstrim.timer
 
+%pre -n lastlog2
+%service_add_pre lastlog2-import.service
+
+%post -n lastlog2
+%tmpfiles_create lastlog2.conf
+%service_add_post lastlog2-import.service
+%{_sbindir}/pam-config -a --lastlog2 --lastlog2-silent_if=gdm,gdm-password,lxdm,lightdm,mdm,sddm
+
+%preun -n lastlog2
+%service_del_preun lastlog2-import.service
+
+%postun -n lastlog2
+if [ "$1" -eq 0 ]; then
+    %{_sbindir}/pam-config -d --lastlog2
+fi
+%service_del_postun lastlog2-import.service
+
 %pre -n uuidd
 
 %if 0%{?suse_version} < 1330
@@ -1348,19 +1377,14 @@ rmdir --ignore-fail-on-non-empty /run/run >/dev/null 2>&1 || :
 # ul_extra_bin_sbin
 
 %{_bindir}/findmnt
-%{_bindir}/lastlog2
 %{_bindir}/logger
 %{_bindir}/lsblk
 %{_bindir}/lslogins
-%{_pam_moduledir}/pam_lastlog2.so
 
 %{_mandir}/man8/findmnt.8.gz
-%{_mandir}/man8/lastlog2.8.gz
 %{_mandir}/man1/logger.1.gz
 %{_mandir}/man8/lsblk.8.gz
 %{_mandir}/man1/lslogins.1.gz
-%{_mandir}/man8/pam_lastlog2.8.gz
-%{_unitdir}/lastlog2-import.service
 
 # Exclude core binaries bash-completion
 %exclude %{_datadir}/bash-completion/completions/addpart
@@ -1469,7 +1493,6 @@ rmdir --ignore-fail-on-non-empty /run/run >/dev/null 2>&1 || :
 %exclude %{_datadir}/bash-completion/completions/zramctl
 
 %{_datadir}/bash-completion/completions/findmnt
-%{_datadir}/bash-completion/completions/lastlog2
 %{_datadir}/bash-completion/completions/logger
 %{_datadir}/bash-completion/completions/lsblk
 %{_datadir}/bash-completion/completions/lslogins
@@ -1646,6 +1669,15 @@ rmdir --ignore-fail-on-non-empty /run/run >/dev/null 2>&1 || :
 %{_datadir}/bash-completion/completions/write
 %{_datadir}/bash-completion/completions/mesg
 
+%files -n lastlog2
+%{_bindir}/lastlog2
+%{_pam_moduledir}/pam_lastlog2.so
+%{_mandir}/man8/lastlog2.8.gz
+%{_mandir}/man8/pam_lastlog2.8.gz
+%{_unitdir}/lastlog2-import.service
+%{_tmpfilesdir}/lastlog2.conf
+%{_datadir}/bash-completion/completions/lastlog2
+
 %files -n liblastlog2-2
 %{_libdir}/liblastlog2.so.2
 %{_libdir}/liblastlog2.so.2.*