diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4314ded2..acd41ddd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,6 +18,7 @@ The **patch** part changes incrementally at each release.
 * evolinux-base: default value for "evolinux_ssh_group"
 * evolinux-base: install /sbin/deny
 * evolinux-base: on debian 10 and later, add noexec on /dev/shm
+evolinux-base: on debian 10 and later, add /usr/share/scripts in root's PATH
 * generate-ldif: support MariaDB 10.3
 * haproxy: add a variable to keep the existing configuration
 * listupgrade: install old-kernel-autoremoval script
diff --git a/evolinux-base/tasks/root.yml b/evolinux-base/tasks/root.yml
index ae2d8a89..01ae2ea5 100644
--- a/evolinux-base/tasks/root.yml
+++ b/evolinux-base/tasks/root.yml
@@ -37,6 +37,12 @@
     regexp: "umask [0-9]+"
   when: evolinux_root_umask
 
+- name: "/usr/share/scripts" is present in root's PATH
+  lineinfile:
+    dest: "/root/.profile"
+    line: "PATH=\"${PATH}:/usr/share/scripts\""
+  when: ansible_distribution_major_version | version_compare('10', '>=')
+
 - name: Custom git config for root
   copy:
     src: root/gitconfig