diff --git a/CMakeLists.txt b/CMakeLists.txt
index 4ee70287d2..e3c72076dc 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -2549,6 +2549,10 @@ if(BUILD_dumpcap AND PCAP_FOUND)
 				OWNER_READ OWNER_WRITE OWNER_EXECUTE
 				GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE
 	)
+	if(ENABLE_DUMPCAP_GROUP)
+		install(CODE "execute_process(COMMAND chgrp ${DUMPCAP_INSTALL_GROUP} ${CMAKE_INSTALL_FULL_BINDIR}/dumpcap)")
+		install(CODE "execute_process(COMMAND chmod o-x ${CMAKE_INSTALL_FULL_BINDIR}/dumpcap)")
+	endif()
 	if(DUMPCAP_INSTALL_OPTION STREQUAL "capabilities")
 		install( CODE "execute_process(
 			COMMAND
diff --git a/CMakeOptions.txt b/CMakeOptions.txt
index ee42e28738..6d429b57a5 100644
--- a/CMakeOptions.txt
+++ b/CMakeOptions.txt
@@ -86,6 +86,11 @@ option(ENABLE_LIBXML2    "Build with libxml2 support" ON)
 set(DUMPCAP_INSTALL_OPTION   "normal" CACHE STRING "Permissions to install")
 set_property(CACHE DUMPCAP_INSTALL_OPTION PROPERTY STRINGS "normal" "suid" "capabilities")
 
+if(UNIX)
+	option(ENABLE_DUMPCAP_GROUP "Install dumpcap with group ownership and permissions (default \"wireshark\")" OFF)
+	set(DUMPCAP_INSTALL_GROUP "wireshark" CACHE STRING "Group name for dumpcap (must exist)")
+endif()
+
 if(APPLE)
 	option(ENABLE_APPLICATION_BUNDLE "Build a macOS application bundle (Wireshark.app)" ON)
 endif()