diff --git a/ipaserver/install/server/install.py b/ipaserver/install/server/install.py
index b510ec20a..48ce315c4 100644
--- a/ipaserver/install/server/install.py
+++ b/ipaserver/install/server/install.py
@@ -803,6 +803,10 @@ def install(installer):
                             setup_pkinit=not options.no_pkinit,
                             subject_base=options.subject)
 
+    # restart DS to enable ipa-pwd-extop plugin
+    print("Restarting directory server to enable password extension plugin")
+    ds.restart()
+
     if setup_ca:
         ca.install_step_1(False, None, options)
 
diff --git a/ipaserver/install/server/replicainstall.py b/ipaserver/install/server/replicainstall.py
index af9cd30e3..da790dd93 100644
--- a/ipaserver/install/server/replicainstall.py
+++ b/ipaserver/install/server/replicainstall.py
@@ -1376,6 +1376,10 @@ def install(installer):
         setup_pkinit=not options.no_pkinit,
         promote=promote)
 
+    # restart DS to enable ipa-pwd-extop plugin
+    print("Restarting directory server to enable password extension plugin")
+    ds.restart()
+
     install_http(
         config,
         auto_redirect=not options.no_ui_redirect,