diff --git a/debian/qubes-core-agent-passwordless-root.postrm b/debian/qubes-core-agent-passwordless-root.postrm
index e07b8ba..a98270b 100755
--- a/debian/qubes-core-agent-passwordless-root.postrm
+++ b/debian/qubes-core-agent-passwordless-root.postrm
@@ -38,6 +38,9 @@ set -e
 
 if [ "${1}" = "remove" ] ; then
     gpasswd -d user sudo
+    if [ "$(passwd -S root|cut -f 2 -d ' ')" = "NP" ]; then
+        passwd -l root
+    fi
 fi
 
 
diff --git a/debian/qubes-core-agent-passwordless-root.preinst b/debian/qubes-core-agent-passwordless-root.preinst
index fdd0079..b72057e 100755
--- a/debian/qubes-core-agent-passwordless-root.preinst
+++ b/debian/qubes-core-agent-passwordless-root.preinst
@@ -35,7 +35,6 @@ set -e
 
 if [ "$1" = "install" ] ; then
     usermod -p '' root
-    usermod -a --groups sudo user
 fi
 
 # dh_installdeb will replace this with shell code automatically