diff --git a/Makefile b/Makefile
index ceefb386e..1c0a9c719 100644
--- a/Makefile
+++ b/Makefile
@@ -203,6 +203,7 @@ endif
 	cp qubes-rpc/qubes.NotifyTools $(DESTDIR)/etc/qubes-rpc/
 	cp qubes-rpc/qubes.NotifyUpdates $(DESTDIR)/etc/qubes-rpc/
 	cp qubes-rpc/qubes.ConnectTCP $(DESTDIR)/etc/qubes-rpc/
+	cp qubes-rpc/qubes.AuthorizeAdminAccess $(DESTDIR)/etc/qubes-rpc/
 	install -m 0755 qvm-tools/qubes-bug-report $(DESTDIR)/usr/bin/qubes-bug-report
 	install -m 0755 qvm-tools/qubes-hcl-report $(DESTDIR)/usr/bin/qubes-hcl-report
 	install -m 0755 qvm-tools/qvm-sync-clock $(DESTDIR)/usr/bin/qvm-sync-clock
diff --git a/qubes-rpc/qubes.AuthorizeAdminAccess b/qubes-rpc/qubes.AuthorizeAdminAccess
new file mode 100755
index 000000000..9c85c85bf
--- /dev/null
+++ b/qubes-rpc/qubes.AuthorizeAdminAccess
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+printf 'authorized\n'
diff --git a/qubes/vm/qubesvm.py b/qubes/vm/qubesvm.py
index 077031f01..2ce741cef 100644
--- a/qubes/vm/qubesvm.py
+++ b/qubes/vm/qubesvm.py
@@ -2877,6 +2877,11 @@ def create_qdb_entries(self):
         self.untrusted_qdb.write("/qubes-block-devices", "")
         self.untrusted_qdb.write("/qubes-usb-devices", "")
 
+        self.untrusted_qdb.write(
+            "/qubes-admin-authz-mode",
+            self.features.check_with_template("admin-authz-mode", ""),
+        )
+
         # TODO: Currently the whole qmemman is quite Xen-specific, so stay with
         # xenstore for it until decided otherwise
         if qmemman_present and self.maxmem:
diff --git a/rpm_spec/core-dom0.spec.in b/rpm_spec/core-dom0.spec.in
index 824391807..8c80ed9c8 100644
--- a/rpm_spec/core-dom0.spec.in
+++ b/rpm_spec/core-dom0.spec.in
@@ -608,6 +608,7 @@ done
 /etc/qubes-rpc/qubes.NotifyTools
 /etc/qubes-rpc/qubes.NotifyUpdates
 /etc/qubes-rpc/qubes.ConnectTCP
+/etc/qubes-rpc/qubes.AuthorizeAdminAccess
 %attr(2770,root,qubes) %dir /var/log/qubes
 %attr(0770,root,qubes) %dir /var/run/qubes