diff --git a/configure.ac b/configure.ac
index 33074b59..3a0a971d 100644
--- a/configure.ac
+++ b/configure.ac
@@ -117,7 +117,7 @@ AC_ARG_ENABLE(all_plugins,
     AS_HELP_STRING([--enable-all-plugins], [Enable all plugins, default: auto]),
 	enable_all_plugins=$enableval, enable_all_plugins=auto)
 AC_PLUGIN([alsa-utils],    [no],  [Save and restore ALSA sound settings using alsactl])
-AC_PLUGIN([dbus],          [no],  [Setup and start system message bus, D-Bus])
+AC_PLUGIN([dbus],          [yes], [Setup and start system message bus, D-Bus])
 AC_PLUGIN([modules-load],  [no],  [Scans /etc/modules-load.d for modules to load])
 AC_PLUGIN([modprobe],      [no],  [Coldplug modules using modalias magic])
 AC_PLUGIN([resolvconf],    [no],  [Setup necessary files for resolvconf])
diff --git a/doc/ChangeLog.md b/doc/ChangeLog.md
index b6c21350..9a3082cc 100644
--- a/doc/ChangeLog.md
+++ b/doc/ChangeLog.md
@@ -8,6 +8,14 @@ All relevant changes are documented in this file.
 
 ### Changes
 
+- The `dbus.so` plugin, which starts an external `dbus-daemon`, is now
+  enabled by default.  It does nothing on systems without a
+  `dbus-daemon` installed, and `--disable-dbus-plugin` opts out.  The
+  daemon it used to register from C now lives in `20-dbus.conf`, and
+  the directories it needs in `tmpfiles.d/dbus.conf`, so both can be
+  overridden from `/etc` like any other system file.  Those
+  directories are no longer chowned to `messagebus`, matching how
+  Finit ships directories for other daemons
 - The `tty` block takes `passenv`, which the line-based format has had
   since v4.4 (issue #286) and the block format was missing
 - New `provides` setting for run/task/service/sysv blocks, naming
diff --git a/doc/build.md b/doc/build.md
index 5deb0ec8..0d9cc5cf 100644
--- a/doc/build.md
+++ b/doc/build.md
@@ -53,14 +53,16 @@ Below are a few of the main switches to configure:
 
 * `--disable-dbus`: Opt out of Finit's built-in D-Bus support, enabled by
   default.  See [D-Bus Integration](dbus.md) for what it provides.  Not to
-  be confused with `--enable-dbus-plugin` below, which only starts an
-  external `dbus-daemon`
+  be confused with `--disable-dbus-plugin` below, which only governs
+  starting an external `dbus-daemon`
 
 * `--enable-alsa-utils-plugin`: Enable the optional `alsa-utils.so` sound plugin.
 
-* `--enable-dbus-plugin`: Enable the optional D-Bus `dbus.so` plugin, which
-  launches `dbus-daemon` at boot.  Unrelated to the built-in bus, see
-  `--disable-dbus` above.
+* `--disable-dbus-plugin`: Drop the `dbus.so` plugin, which launches
+  `dbus-daemon` at boot.  Enabled by default; the plugin does nothing on
+  a system that has no `dbus-daemon` installed, so opting out is only
+  needed to keep init from starting a bus on a system that has one.
+  Unrelated to the built-in bus, see `--disable-dbus` above.
 
 * `--enable-resolvconf-plugin`: Enable the `resolvconf.so` optional plugin.
 
diff --git a/doc/plugins.md b/doc/plugins.md
index 36b6ddde..458544a7 100644
--- a/doc/plugins.md
+++ b/doc/plugins.md
@@ -35,7 +35,10 @@ For your convenience a set of *optional* plugins are available:
 > the `/etc/fstab` file and in the Linux kernel config.
 
 * *dbus.so*: Setup and start system message bus, D-Bus, at boot.
-  _Optional plugin._
+  Enabled by default, and a no-op on systems without a `dbus-daemon`.
+  The daemon is declared in `20-dbus.conf` and its directories in
+  `tmpfiles.d/dbus.conf`, both overridable from `/etc`; the plugin
+  itself only handles what has to inspect the running system.
 
 * *hook-scripts.so*: Trigger the execution of scripts from plugin hook
   points (see [Hooks](#hooks)).  _Optional plugin._
diff --git a/plugins/dbus.c b/plugins/dbus.c
index 80c653e9..39b6ec02 100644
--- a/plugins/dbus.c
+++ b/plugins/dbus.c
@@ -32,22 +32,11 @@
 #include "config.h"
 #include "helpers.h"
 #include "plugin.h"
-#include "service.h"
-#include "util.h"
 #include "conf.h"
+#include "util.h"
 #include "log.h"
 
 #define DBUS_DAEMON "dbus-daemon"
-#define DBUS_ARGS   "--nofork --system --syslog-only"
-#define DBUS_DESC   "D-Bus message bus daemon"
-
-#ifndef DBUS_DAEMONUSER
-#define DBUS_DAEMONUSER "messagebus"
-#endif
-
-#ifndef DBUS_DAEMONGROUP
-#define DBUS_DAEMONGROUP "messagebus"
-#endif
 
 /*
  * Dumnpster diving for the D-Bus main configuration file
@@ -96,79 +85,35 @@ static char *dbus_pidfn(void)
 	return NULL;
 }
 
+/*
+ * The directories live in tmpfiles.d/dbus.conf and the service in
+ * system/20-dbus.conf, both of which an administrator can override.
+ * What is left needs to look at the running system, so it stays here.
+ */
 static void setup(void *arg)
 {
-	char *group = DBUS_DAEMONGROUP;
-	char *user = DBUS_DAEMONUSER;
-	char esccmd[256];
-	char pid[300];
 	char *pidfn;
-	mode_t prev;
-	char *cmd;
 
 	if (rescue) {
 		dbg("Skipping %s plugin in rescue mode.", "dbus");
 		return;
 	}
 
-	cmd = which(DBUS_DAEMON);
-	if (!cmd) {
+	if (!whichp(DBUS_DAEMON)) {
 		dbg("Skipping plugin, %s is not installed.", DBUS_DAEMON);
 		return;
 	}
 
-	if (getuser(user, NULL) == -1) {
-		if (getuser("dbus", NULL) == -1)
-			user = "root"; /* fallback */
-		else
-			user = "dbus"; /* e.g., Buildroot */
-	}
-
-	if (getgroup(group) == -1) {
-		if (getgroup("dbus") == -1)
-			group = "root"; /* fallback */
-		else
-			group = "dbus"; /* e.g., Buildroot */
-	}
-
 	/* Clean up from any previous pre-bootstrap run */
 	pidfn = dbus_pidfn();
-	if (pidfn)
+	if (pidfn) {
 		remove(pidfn);
-
-	dbg("Creating D-Bus Required Directories ...");
-	prev = umask(0);
-	mksubsys("/var/run/dbus", 0755, user, group);
-	mksubsys("/var/run/lock/subsys", 0755, user, group);
-	mksubsys("/var/lib/dbus", 0755, user, group);
-	mksubsys("/tmp/dbus", 0755, user, group);
-	umask(prev);
+		free(pidfn);
+	}
 
 	/* Generate machine id for dbus */
 	if (whichp("dbus-uuidgen"))
 		run_interactive("dbus-uuidgen --ensure", "Verifying D-Bus machine UUID");
-
-	/*
-	 * Register service with Finit
-	 * Note: dbus drops privs after starting up.
-	 */
-	pid[0] = 0;
-	if (pidfn) {
-		char esc[280];
-
-		snprintf(pid, sizeof(pid), "\tpidfile     = \"%s\"\n",
-			 conf_escape(pidfn, esc, sizeof(esc)));
-		free(pidfn);
-	}
-	conf_save_service(SVC_TYPE_SERVICE, "dbus", "dbus.conf",
-			  "\tdescription = \"" DBUS_DESC "\"\n"
-			  "\trunlevel    = \"S123456789\"\n"
-			  "\tnotify      = \"none\"\n"
-			  "\tcgroup system {}\n"
-			  "%s"
-			  "\tcommand     = \"%s " DBUS_ARGS "\"\n",
-			  pid, conf_escape(cmd, esccmd, sizeof(esccmd)));
-	free(cmd);
 }
 
 static plugin_t plugin = {
diff --git a/system/20-dbus.conf b/system/20-dbus.conf
new file mode 100644
index 00000000..f68f23ab
--- /dev/null
+++ b/system/20-dbus.conf
@@ -0,0 +1,19 @@
+# System message bus, D-Bus
+#
+# The dbus.so plugin creates the directories dbus-daemon needs and makes
+# sure the machine has a UUID, but the daemon itself is declared here so
+# you can change it.  The leading '-' says it is fine if dbus-daemon is
+# not installed; the service is then skipped without a warning.
+#
+# Finit registers org.finit on this bus once it is up, see docs/dbus.md.
+#
+# Override this file by copying it to /etc/finit.d/, using the same name,
+# then change the contents any way you like, it can even be empty.
+
+service dbus {
+	description = "D-Bus message bus daemon"
+	runlevel    = "S123456789"
+	notify      = "none"
+	cgroup system {}
+	command     = "-dbus-daemon --nofork --system --syslog-only"
+}
diff --git a/system/Makefile.am b/system/Makefile.am
index 5dac235b..284aebf9 100644
--- a/system/Makefile.am
+++ b/system/Makefile.am
@@ -7,6 +7,10 @@ if BUILD_HOTPLUG_PLUGIN
 system_DATA      += 10-hotplug.conf
 endif
 
+if BUILD_DBUS_PLUGIN
+dist_system_DATA += 20-dbus.conf
+endif
+
 if BUILD_TESTSERV_PLUGIN
 dist_system_DATA += 90-testserv.conf
 endif
diff --git a/tmpfiles.d/Makefile.am b/tmpfiles.d/Makefile.am
index 5155277c..facb9722 100644
--- a/tmpfiles.d/Makefile.am
+++ b/tmpfiles.d/Makefile.am
@@ -6,6 +6,10 @@ dist_tmpfiles_DATA    = etc.conf legacy.conf var.conf
 dist_tmpfiles_DATA   += dnsmasq.conf frr.conf lldpd.conf openswan.conf \
 			quagga.conf sshd.conf uuidd.conf
 
+if BUILD_DBUS_PLUGIN
+dist_tmpfiles_DATA   += dbus.conf
+endif
+
 if BUILD_TESTSERV_PLUGIN
 dist_tmpfiles_DATA   += testserv.conf
 endif
diff --git a/tmpfiles.d/dbus.conf b/tmpfiles.d/dbus.conf
new file mode 100644
index 00000000..f98e0252
--- /dev/null
+++ b/tmpfiles.d/dbus.conf
@@ -0,0 +1,4 @@
+d /var/run/dbus		0755 - - -
+d /var/run/lock/subsys	0755 - - -
+d /var/lib/dbus		0755 - - -
+d /tmp/dbus		0755 - - -