diff --git a/main/postmarketos-base-downstream/APKBUILD b/main/postmarketos-base-downstream/APKBUILD
index 972018cf2..b5d99d708 100644
--- a/main/postmarketos-base-downstream/APKBUILD
+++ b/main/postmarketos-base-downstream/APKBUILD
@@ -1,16 +1,17 @@
 maintainer="Henrik Grimler <henrik@grimler.se>"
 pkgname=postmarketos-base-downstream
-pkgver=2
-pkgrel=1
+pkgver=3
+pkgrel=0
 pkgdesc="Base package for devices with downstream (vendor) kernels"
 url="https://postmarketos.org"
 arch="noarch"
 license="GPL-3.0-or-later"
-install="$pkgname-msm-modem-openrc.post-install"
+install="$pkgname-msm-modem-openrc.post-install $pkgname-dropbear.post-install"
 subpackages="
 	$pkgname-disable-udev-v4l:disable_udev_v4l
 	$pkgname-lightdm
 	$pkgname-msm-modem-openrc:msm_modem_openrc
+	$pkgname-dropbear
 "
 source="10-logind-check-graphical.conf"
 
@@ -40,6 +41,13 @@ msm_modem_openrc() {
 	mkdir -p "$subpkgdir"
 }
 
+dropbear() {
+	pkgdesc="Use dropbear when OpenSSH cannot run (no getrandom on old kernels)"
+	depends="dropbear dropbear-openrc"
+	install_if="$pkgname=$pkgver-r$pkgrel openssh-server-pam"
+	mkdir -p "$subpkgdir"
+}
+
 sha512sums="
 00addbea452dd3e2cb90e18793becc47d22118e6b99a79b76eb57db02aa8b00b133569beaea81cce4b39c9e556280c1d6ac8ab687016354e2d189734e38768cf  10-logind-check-graphical.conf
 "
diff --git a/main/postmarketos-base-downstream/postmarketos-base-downstream-dropbear.post-install b/main/postmarketos-base-downstream/postmarketos-base-downstream-dropbear.post-install
new file mode 100644
index 000000000..f59f09bf9
--- /dev/null
+++ b/main/postmarketos-base-downstream/postmarketos-base-downstream-dropbear.post-install
@@ -0,0 +1,3 @@
+#!/bin/sh
+rc-update add dropbear default 2>/dev/null || true
+rc-update del sshd default 2>/dev/null || true