diff --git a/base/util-linux/util-linux.conf b/base/util-linux/util-linux.conf
index 0d7d4c082..fd4a70233 100644
--- a/base/util-linux/util-linux.conf
+++ b/base/util-linux/util-linux.conf
@@ -22,3 +22,10 @@ hook_add premake 5 'touch aclocal.m4'
 
 # 'for' loop initial declarations are only allowed in C99 mode
 var_append GCC_WRAPPER_APPEND ' ' '-std=c99'
+
+# use su, login from shadow package if available
+# Note: the variants provided by util-linux require pam
+if pkginstalled shadow; then
+	var_append extraconfopt ' ' "--disable-su"
+	var_append extraconfopt ' ' "--disable-login"
+fi