diff --git a/distribution/packages/build.gradle b/distribution/packages/build.gradle
index 0f47f8263a7c5..6c5d149a10a31 100644
--- a/distribution/packages/build.gradle
+++ b/distribution/packages/build.gradle
@@ -96,6 +96,9 @@ Closure commonPackageConfig(String type) {
     postInstall file("${scripts}/postinst")
     preUninstall file("${scripts}/prerm")
     postUninstall file("${scripts}/postrm")
+    if (type == 'rpm') {
+      postTrans file("${scripts}/posttrans")
+    }
 
     // top level "into" directive is not inherited from ospackage for some reason, so we must
     // specify it again explicitly for copying common files
diff --git a/distribution/packages/src/common/scripts/postinst b/distribution/packages/src/common/scripts/postinst
index abc7c91b81d78..38e1f4452ad2a 100644
--- a/distribution/packages/src/common/scripts/postinst
+++ b/distribution/packages/src/common/scripts/postinst
@@ -19,18 +19,22 @@ case "$1" in
         if [ -n $2 ]; then
             IS_UPGRADE=true
         fi
+        PACKAGE=deb
     ;;
     abort-upgrade|abort-remove|abort-deconfigure)
+        PACKAGE=deb
     ;;
 
     # RedHat ####################################################
     1)
         # If $1=1 this is an install
         IS_UPGRADE=false
+        PACKAGE=rpm
     ;;
     2)
         # If $1=1 this is an upgrade
         IS_UPGRADE=true
+        PACKAGE=rpm
     ;;
 
     *)
@@ -99,7 +103,8 @@ if [ -f ${path.env} ]; then
     chown root:elasticsearch ${path.env}
 fi
 
-if [ ! -f /etc/elasticsearch/elasticsearch.keystore ]; then
+# the equivalent code for rpm is in posttrans
+if [ "$PACKAGE" = "deb" -a ! -f /etc/elasticsearch/elasticsearch.keystore ]; then
     /usr/share/elasticsearch/bin/elasticsearch-keystore create
     chown root:elasticsearch /etc/elasticsearch/elasticsearch.keystore
     chmod 660 /etc/elasticsearch/elasticsearch.keystore
diff --git a/distribution/packages/src/common/scripts/posttrans b/distribution/packages/src/common/scripts/posttrans
new file mode 100644
index 0000000000000..d3550bdbed24b
--- /dev/null
+++ b/distribution/packages/src/common/scripts/posttrans
@@ -0,0 +1,8 @@
+if [ ! -f /etc/elasticsearch/elasticsearch.keystore ]; then
+    /usr/share/elasticsearch/bin/elasticsearch-keystore create
+    chown root:elasticsearch /etc/elasticsearch/elasticsearch.keystore
+    chmod 660 /etc/elasticsearch/elasticsearch.keystore
+    md5sum /etc/elasticsearch/elasticsearch.keystore > /etc/elasticsearch/.elasticsearch.keystore.initial_md5sum
+fi
+
+${scripts.footer}