diff --git a/pillar.example b/pillar.example
index 5f0095d..abd7b50 100644
--- a/pillar.example
+++ b/pillar.example
@@ -9,6 +9,7 @@ users:
     fullname: A User
 
   ## Full list of pillar values
+  allow_gid_change: False
   buser:
     fullname: B User
     password: $6$w.............
@@ -27,6 +28,7 @@ users:
     workphone: "(555) 555-5555"
     homephone: "(555) 555-5551"
     manage_vimrc: False
+    allow_gid_change: True
     manage_bashrc: False
     manage_profile: False
     expire: 16426
diff --git a/users/defaults.yaml b/users/defaults.yaml
index b23d0fb..09a0dd9 100644
--- a/users/defaults.yaml
+++ b/users/defaults.yaml
@@ -4,3 +4,6 @@
 users-formula:
   use_vim_formula: False
 
+users:
+  allow_gid_change: True
+
diff --git a/users/init.sls b/users/init.sls
index 33c9448..4ceca7f 100644
--- a/users/init.sls
+++ b/users/init.sls
@@ -151,6 +151,9 @@ users_{{ name }}_user:
     {% if not user.get('unique', True) %}
     - unique: False
     {% endif %}
+    {%- if grains['saltversioninfo'] >= [2018, 3, 1] %}
+    - allow_gid_change: {{ users.allow_gid_change if 'allow_gid_change' not in user else user['allow_gid_change'] }}
+    {%- endif %}
     {% if 'expire' in user -%}
         {% if grains['kernel'].endswith('BSD') and
             user['expire'] < 157766400 %}