diff --git a/Makefile b/Makefile
index 451706951..4915413c6 100644
--- a/Makefile
+++ b/Makefile
@@ -254,6 +254,7 @@ install-common:
 	install -m 0644 qubes-rpc/{qvm-copy.desktop,qvm-move.desktop,qvm-dvm.desktop} $(DESTDIR)/$(KDESERVICEDIR)
 	install -d $(DESTDIR)/etc/qubes-rpc
 	install -m 0644 qubes-rpc/{qubes.Filecopy,qubes.OpenInVM,qubes.VMShell,qubes.SyncNtpClock} $(DESTDIR)/etc/qubes-rpc
+	install -m 0755 qubes-rpc/qubes.VMRootShell $(DESTDIR)/etc/qubes-rpc
 	install -m 0755 qubes-rpc/qubes.OpenURL $(DESTDIR)/etc/qubes-rpc
 	install -m 0644 qubes-rpc/{qubes.SuspendPre,qubes.SuspendPost,qubes.GetAppmenus} $(DESTDIR)/etc/qubes-rpc
 	install -m 0755 qubes-rpc/qubes.SuspendPreAll $(DESTDIR)/etc/qubes-rpc
diff --git a/debian/qubes-core-agent.install b/debian/qubes-core-agent.install
index 1b3b0c2c9..74b042055 100644
--- a/debian/qubes-core-agent.install
+++ b/debian/qubes-core-agent.install
@@ -26,6 +26,7 @@ etc/qubes-rpc/qubes.SuspendPre
 etc/qubes-rpc/qubes.SuspendPreAll
 etc/qubes-rpc/qubes.SyncNtpClock
 etc/qubes-rpc/qubes.VMShell
+etc/qubes-rpc/qubes.VMRootShell
 etc/qubes-rpc/qubes.WaitForSession
 etc/qubes-suspend-module-blacklist
 etc/qubes/autostart/*
diff --git a/qubes-rpc/qubes.VMRootShell b/qubes-rpc/qubes.VMRootShell
new file mode 100755
index 000000000..583de4694
--- /dev/null
+++ b/qubes-rpc/qubes.VMRootShell
@@ -0,0 +1,4 @@
+#!/bin/sh
+# This is the same as qubes.VMShell. The actual difference is in qrexec policy,
+# which contains 'user=root' option.
+exec /bin/bash
diff --git a/rpm_spec/core-agent.spec b/rpm_spec/core-agent.spec
index c44957dbc..f90c77304 100644
--- a/rpm_spec/core-agent.spec
+++ b/rpm_spec/core-agent.spec
@@ -492,6 +492,7 @@ rm -f %{name}-%{version}
 %config(noreplace) /etc/qubes-rpc/qubes.OpenURL
 %config(noreplace) /etc/qubes-rpc/qubes.GetAppmenus
 %config(noreplace) /etc/qubes-rpc/qubes.VMShell
+%config(noreplace) /etc/qubes-rpc/qubes.VMRootShell
 %config(noreplace) /etc/qubes-rpc/qubes.SyncNtpClock
 %config(noreplace) /etc/qubes-rpc/qubes.SuspendPre
 %config(noreplace) /etc/qubes-rpc/qubes.SuspendPreAll