diff --git a/cyrus/manifests/init.pp b/cyrus/manifests/init.pp
index 46260c6..9568daf 100644
--- a/cyrus/manifests/init.pp
+++ b/cyrus/manifests/init.pp
@@ -61,6 +61,11 @@ class cyrus {
         owner   => "root",
         group   => "mail",
         notify  => Service["cyrus-imapd"],
+        exec { "usermod-cyrus-ssl-cert":
+            path    => "/bin:/usr/bin:/sbin:/usr/sbin",
+            command => "usermod -a -G ssl-cert cyrus",
+            unless  => "id -n -G cyrus | grep '\\bssl-cert\\b'",
+        }
     }
 
     file { "/etc/cyrus.conf":
diff --git a/postfix/manifests/init.pp b/postfix/manifests/init.pp
index 8dffa47..183c3b5 100644
--- a/postfix/manifests/init.pp
+++ b/postfix/manifests/init.pp
@@ -89,6 +89,11 @@ class postfix {
         group   => "postfix",
         require => Package["postfix"],
         notify  => Service["postfix"],
+        exec { "usermod-postfix-ssl-cert":
+            path    => "/bin:/usr/bin:/sbin:/usr/sbin",
+            command => "usermod -a -G ssl-cert postfix",
+            unless  => "id -n -G postfix | grep '\\bssl-cert\\b'",
+        }
     }
 
     if $postgrey {