diff --git a/config/deb.am b/config/deb.am
index cdbdbecb35..65aa70687b 100644
--- a/config/deb.am
+++ b/config/deb.am
@@ -62,6 +62,7 @@ deb-utils: deb-local rpm-utils-initramfs
 	pkg8=$${name}-dracut-$${version}.noarch.rpm; \
 	pkg9=$${name}-initramfs-$${version}.$${arch}.rpm; \
 	pkg10=`ls python*-pyzfs-$${version}* | tail -1`; \
+	pkg11=pam_zfs_key-$${version}.$${arch}.rpm; \
 ## Arguments need to be passed to dh_shlibdeps. Alien provides no mechanism
 ## to do this, so we install a shim onto the path which calls the real
 ## dh_shlibdeps with the required arguments.
@@ -77,10 +78,10 @@ deb-utils: deb-local rpm-utils-initramfs
 	env PATH=$${path_prepend}:$${PATH} \
 	fakeroot $(ALIEN) --bump=0 --scripts --to-deb --target=$$debarch \
 	    $$pkg1 $$pkg2 $$pkg3 $$pkg4 $$pkg5 $$pkg6 $$pkg7 \
-	    $$pkg8 $$pkg9 $$pkg10 || exit 1; \
+	    $$pkg8 $$pkg9 $$pkg10 $$pkg11 || exit 1; \
 	$(RM) $${path_prepend}/dh_shlibdeps; \
 	rmdir $${path_prepend}; \
 	$(RM) $$pkg1 $$pkg2 $$pkg3 $$pkg4 $$pkg5 $$pkg6 $$pkg7 \
-	    $$pkg8 $$pkg9 $$pkg10;
+	    $$pkg8 $$pkg9 $$pkg10 $$pkg11;
 
 deb: deb-kmod deb-dkms deb-utils
diff --git a/rpm/generic/zfs.spec.in b/rpm/generic/zfs.spec.in
index bdd77b43da..4b78a93085 100644
--- a/rpm/generic/zfs.spec.in
+++ b/rpm/generic/zfs.spec.in
@@ -118,10 +118,6 @@ BuildRequires:  ncompress
 BuildRequires:  libtirpc-devel
 %endif
 
-%if %{with pam}
-BuildRequires:  pam-devel
-%endif
-
 Requires:       openssl
 %if 0%{?_systemd}
 BuildRequires: systemd
@@ -326,6 +322,19 @@ This package contains a initramfs module used to construct an initramfs
 image which is ZFS aware.
 %endif
 
+%if %{with pam}
+%package -n pam_zfs_key
+Summary:        PAM module for encrypted ZFS datasets
+
+%if 0%{?rhel}%{?centos}%{?fedora}%{?suse_version}
+BuildRequires:  pam-devel
+%endif
+
+%description -n pam_zfs_key
+This package contains the pam_zfs_key PAM module, which provides
+support for unlocking datasets on user login.
+%endif
+
 %prep
 %if %{with debug}
     %define debug --enable-debug
@@ -508,10 +517,6 @@ systemctl --system daemon-reload >/dev/null || true
 %config(noreplace) %{_sysconfdir}/%{name}/zpool.d/*
 %config(noreplace) %{_sysconfdir}/%{name}/vdev_id.conf.*.example
 %attr(440, root, root) %config(noreplace) %{_sysconfdir}/sudoers.d/*
-%if %{with pam}
-%{_libdir}/security/*
-%{_datadir}/pam-configs/*
-%endif
 
 %files -n libzpool5
 %{_libdir}/libzpool.so.*
@@ -561,3 +566,9 @@ systemctl --system daemon-reload >/dev/null || true
 # ignore those files.
 %exclude /usr/share/initramfs-tools
 %endif
+
+%if %{with pam}
+%files -n pam_zfs_key
+%{_libdir}/security/*
+%{_datadir}/pam-configs/*
+%endif