diff --git a/install/updates/10-schema_compat.update b/install/updates/10-schema_compat.update
new file mode 100644
index 000000000..b8f768546
--- /dev/null
+++ b/install/updates/10-schema_compat.update
@@ -0,0 +1,2 @@
+dn: cn=sudoers,cn=Schema Compatibility,cn=plugins,cn=config
+replace: schema-compat-entry-attribute:'sudoRunAsGroup=%deref("ipaSudoRunAs","cn")::sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")'
diff --git a/install/updates/Makefile.am b/install/updates/Makefile.am
index ef1e9b716..38e4cab57 100644
--- a/install/updates/Makefile.am
+++ b/install/updates/Makefile.am
@@ -12,6 +12,7 @@ app_DATA =				\
 	20-indices.update		\
 	20-nss_ldap.update		\
 	20-replication.update		\
+	10-schema_compat.update		\
 	20-user_private_groups.update	\
 	20-winsync_index.update		\
 	21-replicas_container.update	\