diff --git a/obuspa/Makefile b/obuspa/Makefile
index 55c03fa0a..86552477a 100644
--- a/obuspa/Makefile
+++ b/obuspa/Makefile
@@ -5,7 +5,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=obuspa
-PKG_VERSION:=9.0.4.14
+PKG_VERSION:=9.0.4.15
 
 LOCAL_DEV:=0
 ifneq ($(LOCAL_DEV),1)
@@ -129,6 +129,7 @@ define Package/obuspa/install
 	$(INSTALL_DATA) ./files/etc/obuspa/usp_utils.sh $(1)/etc/obuspa/
 	echo "$(VENDOR_PREFIX)" > $(1)/etc/obuspa/vendor_prefix
 	$(INSTALL_BIN) ./files/etc/uci-defaults/01-fix-upgrade-uci $(1)/etc/uci-defaults/
+	$(INSTALL_BIN) ./files/etc/uci-defaults/40-add-obuspa-static-roles $(1)/etc/uci-defaults/
 	$(INSTALL_BIN) ./files/etc/uci-defaults/60-generate-ctrust-defaults $(1)/etc/uci-defaults/
 	$(INSTALL_BIN) ./files/etc/uci-defaults/obuspa-set-dhcp-option $(1)/etc/uci-defaults/
 	$(INSTALL_BIN) ./files/etc/uci-defaults/92-obuspa_firewall $(1)/etc/uci-defaults/
diff --git a/obuspa/files/etc/uci-defaults/40-add-obuspa-static-roles b/obuspa/files/etc/uci-defaults/40-add-obuspa-static-roles
new file mode 100644
index 000000000..13b750a1b
--- /dev/null
+++ b/obuspa/files/etc/uci-defaults/40-add-obuspa-static-roles
@@ -0,0 +1,25 @@
+#!/bin/sh
+
+if ! uci -q get users.role_full_access >/dev/null; then
+	uci -q set users.role_full_access=role
+	uci -q set users.role_full_access.enabled='1'
+	uci -q set users.role_full_access.role_id='1'
+	uci -q set users.role_full_access.name='full_access'
+	uci -q set users.role_full_access.static='1'
+fi
+
+if ! uci -q get users.role_untrusted >/dev/null; then
+	uci -q set users.role_untrusted=role
+	uci -q set users.role_untrusted.enabled='1'
+	uci -q set users.role_untrusted.role_id='2'
+	uci -q set users.role_untrusted.name='Untrusted'
+	uci -q set users.role_untrusted.static='1'
+fi
+
+if ! uci -q get users.role_extender >/dev/null; then
+	uci -q set users.role_extender=role
+	uci -q set users.role_extender.enabled='1'
+	uci -q set users.role_extender.role_id='3'
+	uci -q set users.role_extender.name='extender'
+	uci -q set users.role_extender.static='1'
+fi