diff --git a/Jinxfile b/Jinxfile
index 9fb285c0..83f02b4c 100644
--- a/Jinxfile
+++ b/Jinxfile
@@ -1,3 +1,8 @@
 JINX_MAJOR_VER=0.6
 export CFLAGS="-O2 -march=x86-64 -pipe -mtune=generic"
 export CXXFLAGS="${CFLAGS}"
+
+copy_install_hook () {
+	cp -v ${base_dir}/install-hooks/${name} ${dest_dir}/INSTALL
+	chmod +x ${dest_dir}/INSTALL
+}
diff --git a/distro-files/etc/rc b/distro-files/etc/rc
index 27e2954e..06a54b85 100644
--- a/distro-files/etc/rc
+++ b/distro-files/etc/rc
@@ -21,5 +21,6 @@ chmod 1777 /tmp/.X11-unix
 
 # do first time boot configuration if needed
 if [ ! -f "/var/lib/.first_boot_done" ]; then
+	echo rc: running first boot script
 	/usr/libexec/astral/first-boot
 fi
diff --git a/distro-files/usr/libexec/astral/first-boot b/distro-files/usr/libexec/astral/first-boot
index dee77e74..9c5171e3 100755
--- a/distro-files/usr/libexec/astral/first-boot
+++ b/distro-files/usr/libexec/astral/first-boot
@@ -1,19 +1,12 @@
 #!/usr/bin/bash
 # this file will be executed on the first boot of the system
-echo first-boot: running first boot script...
-
-# create some directories needed in case they have not been already
-echo first-boot: creating /var directories...
-mkdir -p /var/log
-mkdir -p /var/run
-mkdir -p /var/lib
-
 # run post install hooks
-echo first-boot: running post install hooks...
+echo first-boot: running post install hooks
+mkdir -p /var/log
 xbps-reconfigure -a > /var/log/first_install_reconfigure.log
 
 # all done
 touch /var/lib/.first_boot_done
 
-echo first-boot: syncing disks...
+echo first-boot: syncing disks
 sync
diff --git a/install-hooks/distro-files b/install-hooks/distro-files
new file mode 100644
index 00000000..19e8898a
--- /dev/null
+++ b/install-hooks/distro-files
@@ -0,0 +1,13 @@
+#!/usr/bin/bash
+
+case "$1" in
+pre)
+	;;
+post)
+	mkdir -p /var/log
+	mkdir -p /var/run
+	mkdir -p /var/lib
+	;;
+esac
+
+exit 0
diff --git a/install-hooks/shadow b/install-hooks/shadow
new file mode 100644
index 00000000..5fdc57ae
--- /dev/null
+++ b/install-hooks/shadow
@@ -0,0 +1,15 @@
+#!/usr/bin/bash
+
+case "$1" in
+	pre)
+	
+		;;
+	post)
+		chmod 4755 /usr/bin/passwd
+		chmod 4755 /bin/su
+		chmod 4755 /usr/bin/chsh
+		chmod 4755 /usr/bin/chfn
+		;;
+esac
+
+exit 0
diff --git a/install-hooks/sudo b/install-hooks/sudo
new file mode 100644
index 00000000..e27048f5
--- /dev/null
+++ b/install-hooks/sudo
@@ -0,0 +1,12 @@
+#!/usr/bin/bash
+
+case "$1" in
+	pre)
+	
+		;;
+	post)
+		chmod 4755 /usr/bin/sudo
+		;;
+esac
+
+exit 0
diff --git a/recipes/distro-files b/recipes/distro-files
index f7d977ee..fc01f19b 100644
--- a/recipes/distro-files
+++ b/recipes/distro-files
@@ -22,4 +22,6 @@ package() {
 	ln -fvs /usr/share/games/doom/DOOM1.WAD ${dest_dir}/root/DOOM1.WAD
 	ln -fvs /usr/share/games/doom/DOOM1.WAD ${dest_dir}/home/astral/DOOM1.WAD
 	ln -fvs /usr/share/games/doom/DOOM1.WAD ${dest_dir}/etc/skel/DOOM1.WAD
+
+	copy_install_hook
 }
diff --git a/recipes/shadow b/recipes/shadow
index 7914bf33..61e0d19c 100644
--- a/recipes/shadow
+++ b/recipes/shadow
@@ -22,4 +22,5 @@ build() {
 
 package() {
 	make install DESTDIR=${dest_dir}
+	copy_install_hook
 }
diff --git a/recipes/sudo b/recipes/sudo
index eac7e808..38656249 100644
--- a/recipes/sudo
+++ b/recipes/sudo
@@ -21,4 +21,6 @@ package() {
 	echo "astral ALL=(ALL:ALL) ALL" >> ${dest_dir}/etc/sudoers
 	chmod ${mode} ${dest_dir}/etc/sudoers
 	chmod u+s ${dest_dir}/etc/sudoers
+
+	copy_install_hook
 }