diff --git a/nixos/modules/config/system-path.nix b/nixos/modules/config/system-path.nix
index 2f61947c3bcc..1913e17f929d 100644
--- a/nixos/modules/config/system-path.nix
+++ b/nixos/modules/config/system-path.nix
@@ -46,6 +46,7 @@ let
       pkgs.rsync
       pkgs.strace
       pkgs.sysvtools
+      pkgs.su
       pkgs.time
       pkgs.usbutils
       pkgs.utillinux
diff --git a/pkgs/os-specific/linux/shadow/default.nix b/pkgs/os-specific/linux/shadow/default.nix
index 1055fccd8aa3..9d024ae3109c 100644
--- a/pkgs/os-specific/linux/shadow/default.nix
+++ b/pkgs/os-specific/linux/shadow/default.nix
@@ -26,6 +26,8 @@ stdenv.mkDerivation rec {
 
   patches = [ ./keep-path.patch dots_in_usernames ];
 
+  outputs = [ "out" "su" ];
+
   # Assume System V `setpgrp (void)', which is the default on GNU variants
   # (`AC_FUNC_SETPGRP' is not cross-compilation capable.)
   preConfigure = "export ac_cv_func_setpgrp_void=yes";
@@ -35,10 +37,14 @@ stdenv.mkDerivation rec {
       substituteInPlace lib/nscd.c --replace /usr/sbin/nscd ${glibc}/sbin/nscd
     '';
 
-  # Don't install ‘groups’, since coreutils already provides it.
   postInstall =
     ''
+      # Don't install ‘groups’, since coreutils already provides it.
       rm $out/bin/groups $out/share/man/man1/groups.*
+
+      # Move the su binary into the su package
+      mkdir -p $su/bin
+      mv $out/bin/su $su/bin
     '';
 
   meta = {
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index 3f676d37dd87..ec43ee1e64f4 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -36,6 +36,10 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional (ncurses != null) ncurses
     ++ stdenv.lib.optional (perl != null) perl;
 
+  postInstall = ''
+    rm $out/bin/su # su should be supplied by the su package (shadow)
+  '';
+
   enableParallelBuilding = true;
 
   meta = {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4f5f6a909706..244480f65a3f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1998,7 +1998,7 @@ let
 
   stunnel = callPackage ../tools/networking/stunnel { };
 
-  su = shadow;
+  su = shadow.su;
 
   surfraw = callPackage ../tools/networking/surfraw { };