diff --git a/platform.in b/platform.in
index 9ce8c7d9de..541f7b160a 100644
--- a/platform.in
+++ b/platform.in
@@ -68,6 +68,7 @@
 # Standard brp-macro naming:
 # convert all '-' in basename to '_', add two leading underscores.
 %__brp_compress %{_rpmconfigdir}/brp-compress
+%__brp_mangle_shebangs %{_rpmconfigdir}/brp-mangle-shebangs
 %__brp_java_gcjcompile %{_rpmconfigdir}/brp-java-bytecompile
 %__brp_python_bytecompile %{_rpmconfigdir}/brp-python-bytecompile
 %__brp_strip %{_rpmconfigdir}/brp-strip %{__strip}
@@ -77,6 +78,7 @@
 
 %__os_install_post    \
     %{?__brp_compress} \
+    %{?__brp_mangle_shebangs} \
     %{?__brp_strip} \
     %{?__brp_strip_static_archive} \
     %{?__brp_strip_comment_note} \
diff --git a/scripts/Makefile.am b/scripts/Makefile.am
index ab1441d544..48648f350e 100644
--- a/scripts/Makefile.am
+++ b/scripts/Makefile.am
@@ -7,6 +7,7 @@ CLEANFILES =
 
 EXTRA_DIST = \
 	brp-compress brp-python-bytecompile brp-java-gcjcompile \
+	brp-mangle-shebangs \
 	brp-strip brp-strip-comment-note brp-python-hardlink \
 	brp-strip-shared brp-strip-static-archive \
 	check-files check-prereqs \
@@ -27,6 +28,7 @@ EXTRA_DIST = \
 
 rpmconfig_SCRIPTS = \
 	brp-compress brp-python-bytecompile brp-java-gcjcompile \
+	brp-mangle-shebangs \
 	brp-strip brp-strip-comment-note brp-python-hardlink \
 	brp-strip-shared brp-strip-static-archive \
 	check-files check-prereqs \
diff --git a/scripts/brp-mangle-shebangs b/scripts/brp-mangle-shebangs
new file mode 100755
index 0000000000..11e520956d
--- /dev/null
+++ b/scripts/brp-mangle-shebangs
@@ -0,0 +1,47 @@
+#!/bin/sh -eu
+
+# If using normal root, avoid changing anything.
+if [ -z "$RPM_BUILD_ROOT" -o "$RPM_BUILD_ROOT" = "/" ]; then
+  exit 0
+fi
+
+cd "$RPM_BUILD_ROOT"
+
+trim() {
+  printf '%s' "$*"
+}
+
+fail=0
+for f in $(find -executable -type f | xargs --no-run-if-empty file -N --mime-type | grep -Po "^\K.+(?=: text/)"); do
+
+  ts=$(stat -c %y "$f")
+
+  read orig_shebang < "$f" || :
+  shebang=$(trim $(echo "$orig_shebang" | grep -Po "#!\K.*" || echo))
+  if [ -z "$shebang" ]; then
+    echo >&2 "*** WARNING: $f is executable but has empty or no shebang, removing executable bit"
+    chmod -x "$f"
+    touch -d "$ts" "$f"
+    continue
+  elif [ "${shebang%${shebang#?}}" != "/" ]; then
+    echo >&2 "*** ERROR: $f has shebang which doesn't start with '/' ($shebang)"
+    fail=1
+    continue
+  fi
+
+  if ! { echo "$shebang" | grep -q -P "^/(?:usr/)?(?:bin|sbin)/"; }; then
+    continue
+  fi
+
+  # Replace "special" env shebang:
+  # /whatsoever/env foo → /whatsoever/foo
+  shebang=$(echo "$shebang" | sed -r -e 's@^(.+/)env (.+)$@\1\2@')
+
+  if [ "#!$shebang" != "$orig_shebang" ]; then
+    sed -i -e "1c #!$shebang" "$f"
+  fi
+
+  touch -d "$ts" "$f"
+done
+
+exit $fail