diff --git a/debian/local/pam-auth-update b/debian/local/pam-auth-update
old mode 100644
new mode 100755
index 0d48ea6..06fe172
--- a/debian/local/pam-auth-update
+++ b/debian/local/pam-auth-update
@@ -39,7 +39,7 @@ my $blanktemplate = 'libpam-runtime/no_profiles_chosen';
 my $titletemplate = 'libpam-runtime/title';
 my $confdir = '/etc/pam.d';
 my $savedir = '/var/lib/pam';
-my (%profiles, @sorted, @enabled, @conflicts, @new, %removals);
+my (%profiles, @sorted, @enabled, @conflicts, @new, %removals, %to_enable);
 my $force = 0;
 my $package = 0;
 my $priority = 'high';
@@ -91,6 +91,13 @@ while ($#ARGV >= 0) {
 		}
 		# --remove implies --package
 		$package = 1 if (keys(%removals));
+	} elsif ($opt eq '--enable') {
+		while ($#ARGV >= 0) {
+			last if ($ARGV[0] =~ /^--/);
+			$to_enable{shift @ARGV} = 1;
+		}
+		# --enable implies --package
+		$package = 1 if (keys(%to_enable));
 	}
 }
 
@@ -138,6 +145,10 @@ if (!@enabled) {
 	$priority = 'high' unless ($force);
 }
 
+# add configs to enable
+push(@enabled,
+     grep { $to_enable{$_} } @sorted);
+
 # add any previously-unseen configs
 push(@enabled,
      grep { $profiles{$_}->{'Default'} eq 'yes' && !$seen{$_} } @sorted);
diff --git a/debian/local/pam-auth-update.8 b/debian/local/pam-auth-update.8
index fd5e2ad..a5ebdba 100644
--- a/debian/local/pam-auth-update.8
+++ b/debian/local/pam-auth-update.8
@@ -68,6 +68,10 @@ Indicate that the caller is a package maintainer script; lowers the
 priority of debconf questions to `medium' so that the user is not
 prompted by default.
 .TP
+.B \-\-enable \fIprofile \fR[\fIprofile\fR...]
+Enable the specified profiles in system configuration. This is used to
+enable profiles that are not on by default.
+.TP
 .B \-\-remove \fIprofile \fR[\fIprofile\fR...]
 Remove the specified profiles from the system configuration.
 .B pam\-auth\-update \-\-remove