diff --git a/contrib/fwupd.spec.in b/contrib/fwupd.spec.in
index 648ffee6c..734dda92d 100644
--- a/contrib/fwupd.spec.in
+++ b/contrib/fwupd.spec.in
@@ -47,6 +47,7 @@ make install DESTDIR=$RPM_BUILD_ROOT
 %{_sysconfdir}/dbus-1/system.d/org.freedesktop.fwupd.conf
 %{_datadir}/dbus-1/interfaces/org.freedesktop.fwupd.xml
 %{_datadir}/polkit-1/actions/org.freedesktop.fwupd.policy
+%{_datadir}/polkit-1/rules.d/org.freedesktop.fwupd.rules
 %{_datadir}/dbus-1/system-services/org.freedesktop.fwupd.service
 %{_datadir}/man/man1/fwupdmgr.1.gz
 %dir %{_localstatedir}/lib/fwupd
diff --git a/policy/Makefile.am b/policy/Makefile.am
index 79d06d0f0..49200bc94 100644
--- a/policy/Makefile.am
+++ b/policy/Makefile.am
@@ -1,3 +1,8 @@
+
+polkit_rulesdir = $(datadir)/polkit-1/rules.d
+dist_polkit_rules_DATA =				\
+	org.freedesktop.fwupd.rules
+
 @INTLTOOL_POLICY_RULE@
 polkit_policydir = $(datadir)/polkit-1/actions
 polkit_policy_in_files = org.freedesktop.fwupd.policy.in
diff --git a/policy/org.freedesktop.fwupd.rules b/policy/org.freedesktop.fwupd.rules
new file mode 100644
index 000000000..651d4e355
--- /dev/null
+++ b/policy/org.freedesktop.fwupd.rules
@@ -0,0 +1,7 @@
+polkit.addRule(function(action, subject) {
+    if (action.id == "org.freedesktop.fwupd.update-internal" &&
+        subject.active == true && subject.local == true &&
+        subject.isInGroup("wheel")) {
+            return polkit.Result.YES;
+    }
+});