diff --git a/postfix.spec b/postfix.spec
index 8a5fd40..d2dcf3a 100644
--- a/postfix.spec
+++ b/postfix.spec
@@ -49,15 +49,13 @@
 Name: postfix
 Summary: Postfix Mail Transport Agent
 Version: 3.5.9
-Release: 21%{?dist}
+Release: 22%{?dist}
 Epoch: 2
 URL: http://www.postfix.org
 License: (IBM and GPLv2+) or (EPL-2.0 and GPLv2+)
 Requires(post): systemd systemd-sysv hostname
 Requires(post): %{_sbindir}/alternatives
 Requires(post): %{_bindir}/openssl
-Requires(pre): %{_sbindir}/groupadd
-Requires(pre): %{_sbindir}/useradd
 Requires(preun): %{_sbindir}/alternatives
 Requires(preun): systemd
 Requires(postun): systemd
@@ -74,6 +72,7 @@ Source2: postfix.service
 Source3: README-Postfix-SASL-RedHat.txt
 Source4: postfix.aliasesdb
 Source5: postfix-chroot-update
+Source6: postfix.sysusers
 
 # Sources 50-99 are upstream [patch] contributions
 
@@ -120,6 +119,7 @@ BuildRequires: make
 BuildRequires: libdb-devel, perl-generators, pkgconfig, zlib-devel
 BuildRequires: systemd-units, libicu-devel
 BuildRequires: gcc, m4, findutils
+BuildRequires: systemd-rpm-macros
 %if 0%{?rhel} < 9
 BuildRequires: libnsl2-devel
 %endif
@@ -389,6 +389,9 @@ install -m 644 %{SOURCE2} %{buildroot}%{_unitdir}
 install -m 755 %{SOURCE4} %{buildroot}%{postfix_daemon_dir}/aliasesdb
 install -m 755 %{SOURCE5} %{buildroot}%{postfix_daemon_dir}/chroot-update
 
+# systemd-sysusers
+install -p -D -m 0644 %{SOURCE6} %{buildroot}%{_sysusersdir}/postfix.conf
+
 install -c auxiliary/rmail/rmail $RPM_BUILD_ROOT%{_bindir}/rmail.postfix
 
 for i in active bounce corrupt defer deferred flush incoming private saved maildrop public pid saved trace; do
@@ -544,10 +547,7 @@ exit 0
 
 %pre
 # Add user and groups if necessary
-%{_sbindir}/groupadd -g %{maildrop_gid} -r %{maildrop_group} 2>/dev/null
-%{_sbindir}/groupadd -g %{postfix_gid} -r %{postfix_group} 2>/dev/null
-%{_sbindir}/groupadd -g 12 -r mail 2>/dev/null
-%{_sbindir}/useradd -d %{postfix_queue_dir} -s /sbin/nologin -g %{postfix_group} -G mail -M -r -u %{postfix_uid} %{postfix_user} 2>/dev/null
+%sysusers_create_compat %{SOURCE6}
 
 # hack, to turn man8/smtpd.8.gz into alternatives symlink (part of the rhbz#1051180 fix)
 # this could be probably dropped in f23+
@@ -731,6 +731,9 @@ fi
 
 %ghost %attr(0644, root, root) %{_var}/lib/misc/postfix.aliasesdb-stamp
 
+# systemd-sysusers
+%{_sysusersdir}/postfix.conf
+
 %if 0%{?fedora} < 23 && 0%{?rhel} < 9
 %files sysvinit
 %{_initrddir}/postfix
@@ -809,6 +812,10 @@ fi
 %endif
 
 %changelog
+* Wed Jul 05 2023 Jonathan Wright <jonathan@almalinux.org> - 2:3.5.9-22
+- Use systemd-sysusers
+  Resolves: rhbz#2095454
+
 * Wed May 17 2023 Tomas Korbar <tkorbar@redhat.com> - 2:3.5.9-21
 - Fix patch for SRV record resolution feature
   Related: rhbz#2134789
diff --git a/postfix.sysusers b/postfix.sysusers
new file mode 100644
index 0000000..876b305
--- /dev/null
+++ b/postfix.sysusers
@@ -0,0 +1,4 @@
+u postfix 89 - /var/spool/postfix /sbin/nologin
+g postdrop 90
+g mail 12
+m postfix mail