diff --git a/shadow.be0 b/shadow.be0
index 3b790af25..bffb7853b 100755
--- a/shadow.be0
+++ b/shadow.be0
@@ -1,9 +1,10 @@
 #!/usr/bin/env beesh
 
-# BEE_VERSION shadow-4.1.5.1-3
+# BEE_VERSION shadow-4.12.3-0
+
+#SRCURL[0]="https://github.com/shadow-maint/shadow/releases/download/${PKGVERSION}/shadow-${PKGVERSION}.tar.gz"
+SRCURL[0]="https://beehive.molgen.mpg.de/533afc1c1c0a73be1545f453a2b3c779/shadow-4.12.3.tar.gz"
 
-# dead SRCURL[0]="http://cdn.debian.net/debian/pool/main/s/shadow/shadow_${PKGVERSION}.orig.tar.gz"
-SRCURL[0]="https://beehive.molgen.mpg.de/ae66de9953f840fb3a97f6148bc39a30/shadow_4.1.5.1.orig.tar.gz"
 
 # PATCHURL+=()
 
@@ -15,24 +16,9 @@ SRCURL[0]="https://beehive.molgen.mpg.de/ae66de9953f840fb3a97f6148bc39a30/shadow
 #    bee_extract "${@}"
 #}
 
-mee_patch() {
-    bee_patch "${@}"
-
-    sed -i src/Makefile.in \
-        -e 's/groups$(EXEEXT) //'
-
-    find man \
-         -name Makefile.in \
-         -exec sed -i {} -e 's/groups\.1 / /' \;
-
-    sed -i man/Makefile.in \
-        -e 's/ ko//' -e 's/ zh_CN zh_TW//'
-
-    sed -i etc/login.defs \
-        -e 's@#ENCRYPT_METHOD DES@ENCRYPT_METHOD SHA512@' \
-        -e 's@/var/spool/mail@/var/mail@' \
-        -e 's@DICTPATH.*@DICTPATH\t/lib/cracklib/pw_dict@'
-}
+#mee_patch() {
+#    bee_patch "${@}"
+#}
 
 mee_configure() {
     bee_configure \
@@ -46,8 +32,36 @@ mee_configure() {
 mee_install() {
     bee_install
 
-    for i in login.defs default/useradd pam.d ; do
-        mv -v ${D}${SYSCONFDIR}/${i} ${D}${SYSCONFDIR}/${i}.sample
+    # I guess this is a bug in Makefile.am, because subdir "man" is
+    # only included with ENABLE_REGENERATE_MAN (--enable-man)
+
+    ( cd man ; bee_install )
+
+    # Do not overwrite our configs
+
+    mv ${D}${SYSCONFDIR}/login.defs ${D}${SYSCONFDIR}/login.defs.sample
+    mv ${D}${SYSCONFDIR}/pam.d ${D}${SYSCONFDIR}/pam.d.sample
+
+    # we have the following from coreutils:
+
+    rm $D/usr/bin/groups
+    rm $D/usr/share/man/man1/groups.1
+
+    # Remove tools which do not work on Mariux
+    # Some of these are setuid root and have side effects
+    # (e.g. "passwd" happily adds a record to /etc/shadow)
+
+    for tool in chgpasswd chpasswd groupadd groupdel groupmems groupmod \
+            grpconv grpunconv logoutd newusers pwconv pwunconv \
+            useradd userdel usermod vipw vigr; do
+        rm $D/usr/sbin/$tool
+        rm $D/usr/share/man/man8/$tool.8
+        test -e $D/etc/pam.d.sample/$tool && rm $D/etc/pam.d.sample/$tool
     done
 
+    for tool in chage chfn chsh expiry gpasswd passwd; do
+        rm $D/usr/bin/$tool
+        rm $D/usr/share/man/man1/$tool.1
+        test -e $D/etc/pam.d.sample/$tool && rm $D/etc/pam.d.sample/$tool
+    done
 }