diff --git a/CHANGELOG b/CHANGELOG
index c079ff757f..2e69a73b01 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -9,6 +9,8 @@ git-annex (7.20190913) UNRELEASED; urgency=medium
   * adjust --lock: This enters an adjusted branch where files are locked.
   * remotedaemon: Don't list --stop in help since it's not supported.
   * enable-tor: Run kdesu with -c option.
+  * enable-tor: Use pkexec to run command as root when gksu and kdesu are not
+    available.
 
  -- Joey Hess <id@joeyh.name>  Thu, 19 Sep 2019 11:11:19 -0400
 
diff --git a/Utility/Su.hs b/Utility/Su.hs
index 9d26aac09a..d9ec5e8eed 100644
--- a/Utility/Su.hs
+++ b/Utility/Su.hs
@@ -77,6 +77,8 @@ mkSuCommand cmd ps = firstM (\(SuCommand _ p _) -> inPath p) =<< selectcmds
 			[Param shellcmd]
 		, SuCommand (MayPromptPassword SomePassword) "kdesu"
 			[Param "-c", Param shellcmd]
+		, SuCommand (MayPromptPassword SomePassword) "pkexec"
+			([Param cmd] ++ ps)
 		-- Available in Debian's menu package; knows about lots of
 		-- ways to gain root.
 		, SuCommand (MayPromptPassword SomePassword) "su-to-root"