diff --git a/plist b/plist
index 629e7a523..d0898df38 100644
--- a/plist
+++ b/plist
@@ -116,6 +116,7 @@
 /usr/local/etc/rc.newwanip
 /usr/local/etc/rc.newwanipv6
 /usr/local/etc/rc.openvpn
+/usr/local/etc/rc.plugins_configure
 /usr/local/etc/rc.reboot
 /usr/local/etc/rc.reload_all
 /usr/local/etc/rc.reload_interfaces
@@ -549,7 +550,6 @@
 /usr/local/opnsense/scripts/OPNsense/CaptivePortal/set_session_restrictions.py
 /usr/local/opnsense/scripts/OPNsense/CaptivePortal/sql/init.sql
 /usr/local/opnsense/scripts/OPNsense/CaptivePortal/strip_template.py
-/usr/local/opnsense/scripts/OPNsense/Proxy/plugins.php
 /usr/local/opnsense/scripts/dhcp/get_leases.py
 /usr/local/opnsense/scripts/dns/unbound_dhcpd.py
 /usr/local/opnsense/scripts/filter/delete_table.py
@@ -657,6 +657,7 @@
 /usr/local/opnsense/service/conf/actions.d/actions_netflow.conf
 /usr/local/opnsense/service/conf/actions.d/actions_openssh.conf
 /usr/local/opnsense/service/conf/actions.d/actions_openvpn.conf
+/usr/local/opnsense/service/conf/actions.d/actions_plugins.conf
 /usr/local/opnsense/service/conf/actions.d/actions_proxy.conf
 /usr/local/opnsense/service/conf/actions.d/actions_routedns.conf
 /usr/local/opnsense/service/conf/actions.d/actions_system.conf
@@ -923,6 +924,7 @@
 /usr/local/sbin/ovpn-linkup
 /usr/local/sbin/ovpn_auth_verify
 /usr/local/sbin/ping_hosts.sh
+/usr/local/sbin/pluginctl
 /usr/local/sbin/ppp-linkdown
 /usr/local/sbin/ppp-linkup
 /usr/local/sbin/ppp-log-uptime.sh
diff --git a/src/opnsense/scripts/OPNsense/Proxy/plugins.php b/src/etc/rc.plugins_configure
similarity index 87%
rename from src/opnsense/scripts/OPNsense/Proxy/plugins.php
rename to src/etc/rc.plugins_configure
index a1a4ca0ca..cd2bd936f 100755
--- a/src/opnsense/scripts/OPNsense/Proxy/plugins.php
+++ b/src/etc/rc.plugins_configure
@@ -28,8 +28,11 @@
  */
 
 require_once("config.inc");
+/* XXX we probably need more includes here to be able to accomodate all */
 require_once("plugins.inc");
 
-if (isset($argv[1])) {
-    plugins_configure('webproxy', true, array(trim($argv[1], " \n")));
+if (!empty($argv[1])) {
+    $args = $argv;
+    $hook = array_shift($args);
+    plugins_configure($hook, true, $args);
 }
diff --git a/src/opnsense/mvc/app/controllers/OPNsense/Proxy/Api/ServiceController.php b/src/opnsense/mvc/app/controllers/OPNsense/Proxy/Api/ServiceController.php
index d09979cb7..d41568ff5 100644
--- a/src/opnsense/mvc/app/controllers/OPNsense/Proxy/Api/ServiceController.php
+++ b/src/opnsense/mvc/app/controllers/OPNsense/Proxy/Api/ServiceController.php
@@ -46,7 +46,8 @@ class ServiceController extends ApiControllerBase
     {
         if ($this->request->isPost()) {
             $backend = new Backend();
-            $backend->configdRun('proxy plugins start');
+            /* XXX why don't we run this from the backend directly? */
+            $backend->configdRun('plugins webproxy start');
             $response = $backend->configdRun("proxy start", true);
             return array("response" => $response);
         } else {
@@ -63,7 +64,8 @@ class ServiceController extends ApiControllerBase
         if ($this->request->isPost()) {
             $backend = new Backend();
             $response = $backend->configdRun("proxy stop");
-            $backend->configdRun('proxy plugins stop');
+            /* XXX why don't we run this from the backend directly? */
+            $backend->configdRun('plugins webproxy stop');
             return array("response" => $response);
         } else {
             return array("response" => array());
@@ -78,7 +80,8 @@ class ServiceController extends ApiControllerBase
     {
         if ($this->request->isPost()) {
             $backend = new Backend();
-            $backend->configdRun('proxy plugins restart');
+            /* XXX why don't we run this from the backend directly? */
+            $backend->configdRun('plugins webproxy restart');
             $response = $backend->configdRun("proxy restart");
             return array("response" => $response);
         } else {
@@ -149,11 +152,12 @@ class ServiceController extends ApiControllerBase
 
             // generate template
             $backend->configdRun('template reload OPNsense/Proxy');
-            $backend->configdRun('proxy plugins reconfigure');
 
             // (res)start daemon
             if ($mdlProxy->general->enabled->__toString() == 1) {
                 if ($runStatus['status'] == "running" && !$force_restart) {
+                    /* XXX why don't we run this from the backend directly? */
+                    $backend->configdRun('plugins webproxy reconfigure');
                     $backend->configdRun("proxy reconfigure");
                 } else {
                     $this->startAction();
diff --git a/src/opnsense/service/conf/actions.d/actions_plugins.conf b/src/opnsense/service/conf/actions.d/actions_plugins.conf
new file mode 100644
index 000000000..b641666d3
--- /dev/null
+++ b/src/opnsense/service/conf/actions.d/actions_plugins.conf
@@ -0,0 +1,6 @@
+[configure]
+command:/usr/local/etc/rc.plugins_configure
+parameters:%s %s
+type:script
+message:Running plugin configuration %s %s
+description:Reconfigure a plugin facility
diff --git a/src/opnsense/service/conf/actions.d/actions_proxy.conf b/src/opnsense/service/conf/actions.d/actions_proxy.conf
index 819d4a760..6525f5e2d 100644
--- a/src/opnsense/service/conf/actions.d/actions_proxy.conf
+++ b/src/opnsense/service/conf/actions.d/actions_proxy.conf
@@ -41,10 +41,3 @@ parameters:
 type:script
 message:download proxy ACLs from remote locations
 description:Download external proxy ACLs
-
-[plugins]
-command:/usr/local/opnsense/scripts/OPNsense/Proxy/plugins.php
-parameters:%s
-type:script
-message:run plugins for squid
-description:Run plugins for squid
diff --git a/src/sbin/pluginctl b/src/sbin/pluginctl
new file mode 100755
index 000000000..fc880e617
--- /dev/null
+++ b/src/sbin/pluginctl
@@ -0,0 +1,4 @@
+#!/bin/sh
+
+# launch the real utility from here
+/usr/local/etc/rc.plugins_configure "${@}"