diff --git a/build-scripts/package-msi b/build-scripts/package-msi
index f256cda0e..2483440ef 100755
--- a/build-scripts/package-msi
+++ b/build-scripts/package-msi
@@ -117,6 +117,10 @@ pre() {
         ;;
     esac
 
+    # Copy default leech2 config (ENT-14100)
+    install -d "$P"/state/.leech2
+    install -m 644 "$BASEDIR"/cfengine/dist"$BUILDPREFIX"/state/.leech2/config.json "$P"/state/.leech2/
+
     # Copy WiX source file for MSI generation
     cp "$BASEDIR"/buildscripts/packaging/cfengine-nova/cfengine-nova.wxs "$P"
 
diff --git a/packaging/cfengine-nova-hub/cfengine-nova-hub.spec.in b/packaging/cfengine-nova-hub/cfengine-nova-hub.spec.in
index f60ce716a..18e6bcf27 100644
--- a/packaging/cfengine-nova-hub/cfengine-nova-hub.spec.in
+++ b/packaging/cfengine-nova-hub/cfengine-nova-hub.spec.in
@@ -469,5 +469,10 @@ exit 0
 %dir %prefix/outputs
 %dir %prefix/inputs
 %dir %prefix/state
+%dir %prefix/state/.leech2
+
+# Mode must match the cfengine-nova package, which also ships this file
+%defattr(600,root,root,700)
+%prefix/state/.leech2/config.json
 
 %changelog
diff --git a/packaging/cfengine-nova/cfengine-nova.spec.in b/packaging/cfengine-nova/cfengine-nova.spec.in
index a82bdee03..2d3dbd471 100644
--- a/packaging/cfengine-nova/cfengine-nova.spec.in
+++ b/packaging/cfengine-nova/cfengine-nova.spec.in
@@ -216,6 +216,9 @@ exit 0
 %dir %prefix/outputs
 %dir %prefix/inputs
 %dir %prefix/modules
+%dir %prefix/state
+%dir %prefix/state/.leech2
+%prefix/state/.leech2/config.json
 
 
 %changelog
diff --git a/packaging/cfengine-nova/cfengine-nova.wxs b/packaging/cfengine-nova/cfengine-nova.wxs
index e15a39fb6..9d7c32afc 100644
--- a/packaging/cfengine-nova/cfengine-nova.wxs
+++ b/packaging/cfengine-nova/cfengine-nova.wxs
@@ -177,6 +177,14 @@
               <Component Id='openssl.cnf' Guid='51EF6C21-D0AD-4A29-9F83-B72B5DF614A5' Win64='$(var.isWin64)'>
                 <File Id='openssl.cnf' Name='openssl.cnf' KeyPath='yes' DiskId='1' Source='$(var.CfSourceDir)\ssl\openssl.cnf' />
               </Component>
+            </Directory>
+			<!-- ===== Cfengine\state\.leech2 ===== -->
+            <Directory Id='dir_state' Name='state'>
+              <Directory Id='dir_state_leech2' Name='.leech2'>
+                <Component Id='leech2_config.json' Guid='1781E340-7772-4715-833D-DFAAE22A83EF' Win64='$(var.isWin64)'>
+                  <File Id='leech2_config.json' Name='config.json' KeyPath='yes' DiskId='1' Source='$(var.CfSourceDir)\state\.leech2\config.json' />
+                </Component>
+              </Directory>
             </Directory>
           </Directory>
         </Directory>
@@ -222,6 +230,8 @@
 	    <ComponentRef Id='libcurl_4.dll' />
 
 	    <ComponentRef Id='openssl.cnf' />
+
+	    <ComponentRef Id='leech2_config.json' />
       </Feature>
 
       <UI>
diff --git a/packaging/cfengine-nova/debian/cfengine-nova.install b/packaging/cfengine-nova/debian/cfengine-nova.install
index a3b437c75..e26afa9d2 100644
--- a/packaging/cfengine-nova/debian/cfengine-nova.install
+++ b/packaging/cfengine-nova/debian/cfengine-nova.install
@@ -23,6 +23,7 @@
 /var/cfengine/lib/liblmdb.so
 /var/cfengine/lib/libleech2.so
 /var/cfengine/bin/lch
+/var/cfengine/state/.leech2/config.json
 /var/cfengine/share/doc
 /var/cfengine/modules
 /var/cfengine/inputs