diff --color -ru a/libcap/cap_proc.c b/libcap/cap_proc.c
--- a/libcap/cap_proc.c	2021-12-22 12:33:20.739126763 +0100
+++ b/libcap/cap_proc.c	2021-12-22 12:33:53.195733115 +0100
@@ -406,6 +406,29 @@
 }
 
 /*
+ * cap_prctl performs a prctl() 6 argument call on the current
+ * thread. Use cap_prctlw() if you want to perform a POSIX semantics
+ * prctl() system call.
+ */
+int cap_prctl(long int pr_cmd, long int arg1, long int arg2,
+             long int arg3, long int arg4, long int arg5)
+{
+    return prctl(pr_cmd, arg1, arg2, arg3, arg4, arg5);
+}
+
+/*
+ * cap_prctlw performs a POSIX semantics prctl() call. That is a 6 arg
+ * prctl() call that executes on all available threads when libpsx is
+ * linked. The suffix 'w' refers to the fact one only ever needs to
+ * invoke this is if the call will write some kernel state.
+ */
+int cap_prctlw(long int pr_cmd, long int arg1, long int arg2,
+              long int arg3, long int arg4, long int arg5)
+{
+    return _libcap_wprctl6(&multithread, pr_cmd, arg1, arg2, arg3, arg4, arg5);
+}
+
+/*
  * Some predefined constants
  */
 #define CAP_SECURED_BITS_BASIC                                 \
diff --color -ru a/libcap/include/sys/capability.h b/libcap/include/sys/capability.h
--- a/libcap/include/sys/capability.h	2021-02-05 06:52:17.000000000 +0100
+++ b/libcap/include/sys/capability.h	2021-12-22 12:33:53.196733134 +0100
@@ -175,6 +175,11 @@
 extern unsigned cap_get_secbits(void);
 extern int cap_set_secbits(unsigned bits);
 
+extern int cap_prctl(long int pr_cmd, long int arg1, long int arg2,
+		    long int arg3, long int arg4, long int arg5);
+extern int cap_prctlw(long int pr_cmd, long int arg1, long int arg2,
+		     long int arg3, long int arg4, long int arg5);
+
 extern int cap_setuid(uid_t uid);
 extern int cap_setgroups(gid_t gid, size_t ngroups, const gid_t groups[]);
 
diff --color -ru a/pam_cap/pam_cap.c b/pam_cap/pam_cap.c
--- a/pam_cap/pam_cap.c	2021-12-22 12:33:20.740126781 +0100
+++ b/pam_cap/pam_cap.c	2021-12-22 12:33:53.196733134 +0100
@@ -21,6 +21,7 @@
 #include <string.h>
 #include <syslog.h>
 #include <sys/capability.h>
+#include <sys/prctl.h>
 #include <sys/types.h>
 #include <linux/limits.h>
 
@@ -33,8 +34,11 @@
 
 struct pam_cap_s {
     int debug;
+    int keepcaps;
+    int defer;
     const char *user;
     const char *conf_filename;
+    pam_handle_t *pamh;
 };
 
 /*
@@ -178,6 +182,33 @@
 }
 
 /*
+ * This is the "defer" cleanup function that actually applies the IAB
+ * tuple. This happens really late in the PAM session, hopefully after
+ * the application has performed its setuid() function.
+ */
+static void iab_apply(pam_handle_t *pamh, void *data, int error_status)
+{
+    cap_iab_t iab = data;
+    int retval = error_status & ~(PAM_DATA_REPLACE|PAM_DATA_SILENT);
+
+    data = NULL;
+    if (error_status & PAM_DATA_REPLACE) {
+	goto done;
+    }
+
+    if (retval != PAM_SUCCESS || !(error_status & PAM_DATA_SILENT)) {
+	goto done;
+    }
+
+    if (cap_iab_set_proc(iab) != 0) {
+	D(("IAB setting failed"));
+    }
+
+done:
+    cap_free(iab);
+}
+
+/*
  * Set capabilities for current process to match the current
  * permitted+executable sets combined with the configured inheritable
  * set.
@@ -230,12 +261,21 @@
 	goto cleanup_conf;
     }
 
-    if (!cap_iab_set_proc(iab)) {
+    if (cs->defer) {
+	D(("configured to delay applying IAB"));
+	pam_set_data(cs->pamh, "pam_cap_iab", iab, iab_apply);
+	iab = NULL;
+    } else if (!cap_iab_set_proc(iab)) {
 	D(("able to set the IAB [%s] value", conf_caps));
 	ok = 1;
     }
     cap_free(iab);
 
+    if (cs->keepcaps) {
+	D(("setting keepcaps"));
+	(void) cap_prctlw(PR_SET_KEEPCAPS, 1, 0, 0, 0, 0);
+    }
+
 cleanup_conf:
     memset(conf_caps, 0, conf_caps_length);
     _pam_drop(conf_caps);
@@ -268,6 +308,10 @@
 	    pcs->debug = 1;
 	} else if (!strncmp(*argv, "config=", 7)) {
 	    pcs->conf_filename = 7 + *argv;
+	} else if (!strcmp(*argv, "keepcaps")) {
+	    pcs->keepcaps = 1;
+	} else if (!strcmp(*argv, "defer")) {
+	    pcs->defer = 1;
 	} else {
 	    _pam_log(LOG_ERR, "unknown option; %s", *argv);
 	}
@@ -353,6 +397,7 @@
 	return PAM_AUTH_ERR;
     }
 
+    pcs.pamh = pamh;
     retval = set_capabilities(&pcs);
     memset(&pcs, 0, sizeof(pcs));