diff --git a/cf3/cf.ldapserver b/cf3/cf.ldapserver
index b973dfb3..78051d64 100644
--- a/cf3/cf.ldapserver
+++ b/cf3/cf.ldapserver
@@ -8,6 +8,12 @@ files:
 
   debian.server.installation::
 
+    # slapd no longer ships this directory; Debian Edu also skips slapd's
+    # own configuration, so create the database directory ourselves.
+    "/var/lib/ldap/."
+      create => "true",
+      perms => mog("700","openldap","openldap");
+
     "/etc/ldap/slapd.conf"
     link_from => ln_s("/etc/ldap/slapd-debian-edu-mdb.conf"),
     move_obstructions => "true";
diff --git a/ldap-tools/ldap-debian-edu-install b/ldap-tools/ldap-debian-edu-install
index f1a8c762..908fbf77 100755
--- a/ldap-tools/ldap-debian-edu-install
+++ b/ldap-tools/ldap-debian-edu-install
@@ -183,6 +183,16 @@ dns_stop() {
 # Init tree
 init_ldap () {
 
+  # slapd no longer ships /var/lib/ldap (systemd-sysusers does not
+  # create the openldap home directory) and Debian Edu preseeds
+  # slapd/no_configuration, so slapd's create_ldap_directories() is
+  # never called. slapadd requires the directory to exist.
+  mkdir -p /var/lib/ldap
+  if getent passwd openldap | grep  -q openldap ; then
+     chown openldap:openldap /var/lib/ldap
+  fi
+  chmod 0700 /var/lib/ldap
+
   rm -f /var/lib/ldap/*
 
   if [ -f /etc/shadow ] ; then
diff --git a/debian/debian-edu-config.postinst b/debian/debian-edu-config.postinst
index e4ba32c2..6252bd03 100755
--- a/debian/debian-edu-config.postinst
+++ b/debian/debian-edu-config.postinst
@@ -153,6 +153,15 @@ configure)
 		chmod 0755 /var/lib/debian-edu/
 	    fi
 
+	    # slapd no longer ships /var/lib/ldap (systemd-sysusers does not
+	    # create the openldap home directory) and Debian Edu preseeds
+	    # slapd/no_configuration, so slapd never creates it either.
+	    mkdir -p /var/lib/ldap
+	    if getent passwd openldap >/dev/null && getent group openldap >/dev/null; then
+		chown openldap:openldap /var/lib/ldap
+	    fi
+	    chmod 0700 /var/lib/ldap
+
 	fi
 
     # silence dovecot's message: if you have trouble with authentication failures,