diff --git a/debian/changelog b/debian/changelog
index 90c37253..a2e1b63d 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -4,6 +4,9 @@ livecd-rootfs (2.345) UNRELEASED; urgency=medium
   * lp:~sil2100/livecd-rootfs/pocket-desktop:
     - add support for pocket-desktop
 
+  [ Oliver Grawert ]
+  * add user/group fixes for snappy shipping tpm-tools
+
  -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 21 Sep 2015 16:19:43 +0200
 
 livecd-rootfs (2.344) wily; urgency=medium
diff --git a/live-build/ubuntu-core/hooks/00-uid-gid-fix.chroot_early b/live-build/ubuntu-core/hooks/00-uid-gid-fix.chroot_early
index afdf16c0..41cb2ecb 100755
--- a/live-build/ubuntu-core/hooks/00-uid-gid-fix.chroot_early
+++ b/live-build/ubuntu-core/hooks/00-uid-gid-fix.chroot_early
@@ -45,6 +45,7 @@ systemd-bus-proxy:x:106:111:systemd Bus Proxy,,,:/run/systemd:/bin/false
 docker:x:107:113::/nonexistent:/bin/false
 syslog:x:108:114::/home/syslog:/bin/false
 dnsmasq:x:109:65534:dnsmasq,,,:/var/lib/misc:/bin/false
+tss:x:109:116::/var/lib/tpm:/bin/false
 EOF
 else
     echo "/etc/passwd post-debootstrap hash doesn't match record" >&2
@@ -85,6 +86,7 @@ systemd-bus-proxy:*:16413:0:99999:7:::
 docker:*:16413:0:99999:7:::
 syslog:*:16521:0:99999:7:::
 dnsmasq:*:16644:0:99999:7:::
+tss:*:16701:0:99999:7:::
 EOF
 else
     echo "/etc/shadow post-debootstrap hash doesn't match record" >&2
@@ -149,6 +151,8 @@ systemd-bus-proxy:x:111:
 input:x:112:
 docker:x:113:ubuntu
 syslog:x:114:
+pkcs11:x:115:root
+tss:x:116:
 EOF
 else
     echo "/etc/group post-debootstrap hash doesn't match record" >&2
@@ -213,6 +217,8 @@ systemd-bus-proxy:!::
 input:!::
 docker:!::ubuntu
 syslog:!::
+pkcs11:!::root
+tss:!::
 EOF
 else
     echo "/etc/gshadow post-debootstrap hash doesn't match record" >&2