diff --git a/libexec/rc/rc.d/zfs b/libexec/rc/rc.d/zfs
index 2d35f9b54642..dbc82f82c65b 100755
--- a/libexec/rc/rc.d/zfs
+++ b/libexec/rc/rc.d/zfs
@@ -1,67 +1,79 @@
 #!/bin/sh
 #
 # $FreeBSD$
 #
 
 # PROVIDE: zfs
 # REQUIRE: zfsbe
 # BEFORE: FILESYSTEMS var
 
 . /etc/rc.subr
 
 name="zfs"
 desc="Mount and share ZFS datasets"
 rcvar="zfs_enable"
 start_cmd="zfs_start"
+start_postcmd="zfs_poststart"
 stop_cmd="zfs_stop"
 required_modules="zfs"
 
 zfs_start_jail()
 {
 	if [ `$SYSCTL_N security.jail.mount_allowed` -eq 1 ]; then
 		zfs mount -a
 	fi
 }
 
 zfs_start_main()
 {
 	zfs mount -va
 	zfs share -a
 	if [ ! -r /etc/zfs/exports ]; then
 		touch /etc/zfs/exports
 	fi
 }
 
 zfs_start()
 {
 	if [ `$SYSCTL_N security.jail.jailed` -eq 1 ]; then
 		zfs_start_jail
 	else
 		zfs_start_main
 	fi
 }
 
+zfs_poststart()
+{
+	# Some of the keys to decrypt datasets are potentially stored on ZFS
+	# datasets that just got mounted. Let's try to load those keys and
+	# mount the datasets.
+	if checkyesno zfskeys_enable; then
+		/etc/rc.d/zfskeys start
+		zfs_start
+	fi
+}
+
 zfs_stop_jail()
 {
 	if [ `$SYSCTL_N security.jail.mount_allowed` -eq 1 ]; then
 		zfs unmount -a
 	fi
 }
 
 zfs_stop_main()
 {
 	zfs unshare -a
 	zfs unmount -a
 }
 
 zfs_stop()
 {
 	if [ `$SYSCTL_N security.jail.jailed` -eq 1 ]; then
 		zfs_stop_jail
 	else
 		zfs_stop_main
 	fi
 }
 
 load_rc_config $name
 run_rc_command "$1"