diff --git a/roles/fas_client/files/fas-client-aliases.cron b/roles/fas_client/files/fas-client-aliases.cron
new file mode 100644
index 0000000000..d26aa9cf5c
--- /dev/null
+++ b/roles/fas_client/files/fas-client-aliases.cron
@@ -0,0 +1 @@
+00 19 * * * root /usr/local/bin/lock-wrapper fasClient "/bin/sleep $(($RANDOM \% 45)); /usr/bin/fasClient -ia | /usr/local/bin/nag-once fassync 1d 2>&1"
diff --git a/roles/fas_client/tasks/main.yml b/roles/fas_client/tasks/main.yml
index 1e41b77ff5..d41fd192e6 100644
--- a/roles/fas_client/tasks/main.yml
+++ b/roles/fas_client/tasks/main.yml
@@ -74,6 +74,13 @@
   - config
   - fas_client
 
+- name: fas_client_aliases cron job
+  copy: src=fas-client-aliases.cron dest=/etc/cron.d/fas-client-aliases owner=root mode=644
+  tags:
+  - config
+  - fas_client
+  when: postfix_group is 'gateway'
+
 - name: run fas_client only if we just installed
   command: fasClient -if creates=/var/db/shadow.db
   tags: