diff --git a/installer/scripts/installer.sh b/installer/scripts/installer.sh
index d4a4a1db8..abab9956f 100755
--- a/installer/scripts/installer.sh
+++ b/installer/scripts/installer.sh
@@ -2,6 +2,11 @@
 
 set -eu -o pipefail
 
+if [[ ${EUID} -ne 0 ]]; then
+    echo "This script should be run as root." > /dev/stderr
+    exit 1
+fi
+
 readonly BOX_SRC_DIR=/home/yellowtent/box
 readonly DATA_DIR=/home/yellowtent/data
 readonly CLOUDRON_CONF=/home/yellowtent/configs/cloudron.conf
@@ -41,6 +46,10 @@ while true; do
     echo "Failed to download source tarball, trying again"
     sleep 5
 done
+
+# ensure ownership baked into the tarball is overwritten
+chown -R root.root "${box_src_tmp_dir}"
+
 while true; do
     # for reasons unknown, the dtrace package will fail. but rebuilding second time will work
     if cd "${box_src_tmp_dir}" && npm rebuild; then break; fi
diff --git a/scripts/cloudron-setup b/scripts/cloudron-setup
index 0e227e2e2..722dea23e 100755
--- a/scripts/cloudron-setup
+++ b/scripts/cloudron-setup
@@ -2,6 +2,11 @@
 
 set -eu -o pipefail
 
+if [[ ${EUID} -ne 0 ]]; then
+    echo "This script should be run as root." > /dev/stderr
+    exit 1
+fi
+
 # change this to a hash when we make a upgrade release
 readonly INSTALLER_REVISION=master
 readonly INIT_BASESYSTEM_SCRIPT_URL="https://git.cloudron.io/cloudron/box/raw/${INSTALLER_REVISION}/baseimage/initializeBaseUbuntuImage.sh"