diff --git a/src/cli/dev.js b/src/cli/dev.js
index a284c82dfeb6e..99b7c1a696e49 100644
--- a/src/cli/dev.js
+++ b/src/cli/dev.js
@@ -19,4 +19,5 @@
 
 require('../apm')(process.env.ELASTIC_APM_SERVICE_NAME || 'kibana-proxy');
 require('../setup_node_env');
+require('../setup_node_env/root');
 require('./cli');
diff --git a/src/cli/dist.js b/src/cli/dist.js
index 05f0a68aa495c..bc14a3b530356 100644
--- a/src/cli/dist.js
+++ b/src/cli/dist.js
@@ -19,4 +19,5 @@
 
 require('../apm')();
 require('../setup_node_env/dist');
+require('../setup_node_env/root');
 require('./cli');
diff --git a/src/cli_keystore/dev.js b/src/cli_keystore/dev.js
index 12dc51134aad7..c229d26439bb5 100644
--- a/src/cli_keystore/dev.js
+++ b/src/cli_keystore/dev.js
@@ -17,5 +17,5 @@
  * under the License.
  */
 
-require('../setup_node_env');
+require('../setup_node_env/no_transpilation');
 require('./cli_keystore');
diff --git a/src/dev/build/tasks/os_packages/package_scripts/post_install.sh b/src/dev/build/tasks/os_packages/package_scripts/post_install.sh
index 6eb111e066c83..83ed630058041 100644
--- a/src/dev/build/tasks/os_packages/package_scripts/post_install.sh
+++ b/src/dev/build/tasks/os_packages/package_scripts/post_install.sh
@@ -44,9 +44,11 @@ case $1 in
       IS_UPGRADE=true
     fi
 
+    PACKAGE=deb
     setup
   ;;
   abort-deconfigure|abort-upgrade|abort-remove)
+    PACKAGE=deb
   ;;
 
   # Red Hat
@@ -63,7 +65,8 @@ case $1 in
     if [ "$1" = "2" ]; then
       IS_UPGRADE=true
     fi
-
+  
+    PACKAGE=rpm
     setup
   ;;
 
@@ -86,3 +89,13 @@ if [ "$IS_UPGRADE" = "true" ]; then
     echo " OK"
   fi
 fi
+
+# the equivalent code for rpm is in posttrans
+if [ "$PACKAGE" = "deb" ]; then
+  if [ ! -f "${KBN_PATH_CONF}"/kibana.keystore ]; then
+      /usr/share/kibana/bin/kibana-keystore create
+      chown root:<%= group %> "${KBN_PATH_CONF}"/kibana.keystore
+      chmod 660 "${KBN_PATH_CONF}"/kibana.keystore
+      md5sum "${KBN_PATH_CONF}"/kibana.keystore > "${KBN_PATH_CONF}"/.kibana.keystore.initial_md5sum
+  fi
+fi
diff --git a/src/dev/build/tasks/os_packages/package_scripts/post_trans.sh b/src/dev/build/tasks/os_packages/package_scripts/post_trans.sh
new file mode 100644
index 0000000000000..3c1bd3ccf88b4
--- /dev/null
+++ b/src/dev/build/tasks/os_packages/package_scripts/post_trans.sh
@@ -0,0 +1,8 @@
+export KBN_PATH_CONF=${KBN_PATH_CONF:-<%= configDir %>}
+
+if [ ! -f "${KBN_PATH_CONF}"/kibana.keystore ]; then
+    /usr/share/kibana/bin/kibana-keystore create
+    chown root:<%= group %> "${KBN_PATH_CONF}"/kibana.keystore
+    chmod 660 "${KBN_PATH_CONF}"/kibana.keystore
+    md5sum "${KBN_PATH_CONF}"/kibana.keystore > "${KBN_PATH_CONF}"/.kibana.keystore.initial_md5sum
+fi
diff --git a/src/dev/build/tasks/os_packages/run_fpm.ts b/src/dev/build/tasks/os_packages/run_fpm.ts
index cd39f6c7c256e..def0289f53641 100644
--- a/src/dev/build/tasks/os_packages/run_fpm.ts
+++ b/src/dev/build/tasks/os_packages/run_fpm.ts
@@ -94,6 +94,8 @@ export async function runFpm(
     resolve(__dirname, 'package_scripts/pre_remove.sh'),
     '--after-remove',
     resolve(__dirname, 'package_scripts/post_remove.sh'),
+    '--rpm-posttrans',
+    resolve(__dirname, 'package_scripts/post_trans.sh'),
 
     // tell fpm about the config file so that it is called out in the package definition
     '--config-files',
diff --git a/src/setup_node_env/no_transpilation.js b/src/setup_node_env/no_transpilation.js
index 71fdfa5ad29ea..e989fedcec66f 100644
--- a/src/setup_node_env/no_transpilation.js
+++ b/src/setup_node_env/no_transpilation.js
@@ -24,5 +24,4 @@ require('./harden');
 
 require('symbol-observable');
 require('source-map-support/register');
-require('./root');
 require('./node_version_validator');