diff --git a/usr.sbin/postinstall/postinstall b/usr.sbin/postinstall/postinstall
index e8d8b731cbf4..c6e965051c99 100755
--- a/usr.sbin/postinstall/postinstall
+++ b/usr.sbin/postinstall/postinstall
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# $NetBSD: postinstall,v 1.129 2012/02/15 13:01:00 joerg Exp $
+# $NetBSD: postinstall,v 1.130 2012/02/17 07:51:20 apb Exp $
 #
 # Copyright (c) 2002-2008 The NetBSD Foundation, Inc.
 # All rights reserved.
@@ -53,10 +53,12 @@
 # This script is executed as part of a cross build.  Allow the build
 # environment to override the locations of some tools.
 : ${AWK:=awk}
+: ${DB:=db}
 : ${EGREP:=egrep}
 : ${FGREP:=fgrep}
 : ${GREP:=grep}
 : ${MAKE:=make}
+: ${PWD_MKDB:=/usr/sbin/pwd_mkdb}
 
 #
 #	helper functions
@@ -1106,6 +1108,43 @@ do_pf()
 	return ${failed}
 }
 
+#
+#	pwd_mkdb
+#
+additem pwd_mkdb "passwd database version"
+do_pwd_mkdb()
+{
+	[ -n "$1" ] || err 3 "USAGE: do_pwd_mkdb  fix|check"
+	op="$1"
+	failed=0
+
+	# XXX Ideally, we should figure out the endianness of the
+	# target machine, and add "-E B"/"-E L" to the db(1) flags,
+	# and "-B"/"-L" to the pwd_mkdb(8) flags if the target is not
+	# the same as the host machine.  It probably doesn't matter,
+	# because we don't expect "postinstall fix pwd_mkdb" to be
+	# invoked during a cross build.
+
+	set -- $(${DB} -q -Sb -Ub -To -N hash ${DEST_DIR}/etc/pwd.db \
+		'VERSION\0')
+	case "$2" in
+	'\001\000\000\000') return 0 ;; # version 1, little-endian
+	'\000\000\000\001') return 0 ;; # version 1, big-endian
+	esac
+
+	if [ "${op}" = "check" ]; then
+		msg "Update format of passwd database"
+		failed=1
+	elif ! ${PWD_MKDB} -V 1 ${DEST_DIR}/etc/master.passwd; then
+		msg "Can't update format of passwd database"
+		failed=1
+	else
+		msg "Updated format of passwd database"
+	fi
+
+	return ${failed}
+}
+
 #
 #	rc
 #