On Debian and derivatives, one can override the setuid bit permanently as follows:

    dpkg-statoverride --update --add root root 0755 /usr/bin/pkexec