diff --git a/build/bin/user_setup b/build/bin/user_setup
index 1e36064..2616a75 100755
--- a/build/bin/user_setup
+++ b/build/bin/user_setup
@@ -6,8 +6,7 @@ mkdir -p ${HOME}
 chown ${USER_UID}:0 ${HOME}
 chmod ug+rwx ${HOME}
 
-# runtime user will need to be able to self-insert in /etc/passwd
-chmod g+rw /etc/passwd
+chmod g-w /etc/passwd
 
 # no need for this script to remain in the image after running
 rm $0