diff --git a/user/scripts/update-virtual.rb b/user/scripts/update-virtual.rb
index e3e8271..6d85ec5 100755
--- a/user/scripts/update-virtual.rb
+++ b/user/scripts/update-virtual.rb
@@ -74,15 +74,15 @@ conn.search(basedn, LDAP::LDAP_SCOPE_SUBTREE, filter, attrib) do |entry|
     unless groups.empty?
         virtual << "        groups  => $::operatingsystem ? {\n"
         virtual << "            \"openbsd\" => [ "
-        groups.each { |group| virtual << "\"#{group}\", " }
+        groups.sort.each { |group| virtual << "\"#{group}\", " }
         virtual << "\"wheel\", " if groups.include?("sysadm")
         virtual << "],\n            default   => [ "
-        groups.each { |group| virtual << "\"#{group}\", " }
+        groups.sort.each { |group| virtual << "\"#{group}\", " }
         virtual << "],\n        },\n"
     end
     virtual << "        require => [\n"
     virtual << "            Group[\"#{primarygroup}\"],\n"
-    groups.each { |group| virtual << "            Group[\"#{group}\"],\n" }
+    groups.sort.each { |group| virtual << "            Group[\"#{group}\"],\n" }
     virtual << "        ],\n    }\n"
 end