diff --git a/spindle/engines/nixery/engine.go b/spindle/engines/nixery/engine.go
--- a/spindle/engines/nixery/engine.go
+++ b/spindle/engines/nixery/engine.go
@@ -222,7 +222,7 @@ },
 		},
 		ReadonlyRootfs: false,
 		CapDrop:        []string{"ALL"},
-		CapAdd:         []string{"CAP_DAC_OVERRIDE"},
+		CapAdd:         []string{"CAP_DAC_OVERRIDE", "CAP_CHOWN", "CAP_FOWNER", "CAP_SETUID", "CAP_SETGID"},
 		SecurityOpt:    []string{"no-new-privileges"},
 		ExtraHosts:     []string{"host.docker.internal:host-gateway"},
 	}, nil, nil, "")