diff --git a/upstart-jobs/cron.nix b/upstart-jobs/cron.nix
index a5d628f9a65e..2c9a75cbc6f2 100644
--- a/upstart-jobs/cron.nix
+++ b/upstart-jobs/cron.nix
@@ -88,6 +88,16 @@ in
         # Needed to interpret times in the local timezone.
         env TZ=${config.time.timeZone}
 
+        start script
+            mkdir -m 710 -p /var/cron
+
+            # By default, allow all users to create a crontab.  This
+            # is denoted by the existence of an empty cron.deny file.
+            if ! test -e /var/cron/cron.allow -o -e /var/cron/cron.deny; then
+                touch /var/cron/cron.deny
+            fi
+        end script
+
         respawn ${pkgs.cron}/sbin/cron -n
       '';
     }];