diff --git a/osutil/user.go b/osutil/user.go
index afcc59f2389..25f62d1841e 100644
--- a/osutil/user.go
+++ b/osutil/user.go
@@ -46,12 +46,16 @@ func AddExtraSudoUser(name string, sshKeys []string, gecos string) error {
 		"--gecos", gecos,
 		"--extrausers",
 		"--disabled-password",
-		"--add_extra_groups", "sudo",
 		name)
 	if output, err := cmd.CombinedOutput(); err != nil {
 		return fmt.Errorf("adduser failed with %s: %s", err, output)
 	}
 
+	cmd = exec.Command("adduser", name, "sudo")
+	if output, err := cmd.CombinedOutput(); err != nil {
+		return fmt.Errorf("adding user to sudo group failed with %s: %s", err, output)
+	}
+
 	u, err := userLookup(name)
 	if err != nil {
 		return fmt.Errorf("cannot find user %q: %s", name, err)
diff --git a/osutil/user_test.go b/osutil/user_test.go
index 2959c4b3abc..d12e26437d2 100644
--- a/osutil/user_test.go
+++ b/osutil/user_test.go
@@ -51,7 +51,8 @@ func (s *createUserSuite) TestAddExtraSudoUser(c *check.C) {
 	err := osutil.AddExtraSudoUser("karl", []string{"ssh-key1", "ssh-key2"}, "my gecos")
 	c.Assert(err, check.IsNil)
 	c.Check(mc.Calls(), check.DeepEquals, [][]string{
-		{"adduser", "--force-badname", "--gecos", "my gecos", "--extrausers", "--disabled-password", "--add_extra_groups", "sudo", "karl"},
+		{"adduser", "--force-badname", "--gecos", "my gecos", "--extrausers", "--disabled-password", "karl"},
+		{"adduser", "karl", "sudo"},
 	})
 	sshKeys, err := ioutil.ReadFile(filepath.Join(mockHome, ".ssh", "authorized_keys"))
 	c.Assert(err, check.IsNil)