diff --git a/binhost.sh b/binhost.sh
index 0ca5393..302c217 100755
--- a/binhost.sh
+++ b/binhost.sh
@@ -92,11 +92,12 @@ init_container() {
     echo "Running setup..."
     podman exec "$CONTAINER_NAME" bash -c "
         mkdir -p /root/.gnupg
-        chmod 755 /root/.gnupg
         echo 'allow-loopback-pinentry' > /root/.gnupg/gpg-agent.conf
         gpg-connect-agent reloadagent /bye
         gpg --batch --import /tmp/signing.key
         gpg --export | gpg --homedir /etc/portage/gnupg --import
+        chmod 755 /etc/portage/gnupg
+        chmod 755 /root/.gnupg
         if [[ ! -d /var/db/repos/gentoo/profiles ]]; then
             emerge-webrsync -q
         fi
diff --git a/binhost/make.conf b/binhost/make.conf
index d1c1543..ee536dd 100644
--- a/binhost/make.conf
+++ b/binhost/make.conf
@@ -23,7 +23,7 @@ VIDEO_CARDS="intel nouveau"
 
 # "buildpkg" = generate binary packages upon install
 # "binpkg-multi-instance" = keep only latest version, but support slotting
-FEATURES="${FEATURES} -getbinpkg buildpkg binpkg-multi-instance -ipc-sandbox -network-sandbox -pid-sandbox binpkg-signing"
+FEATURES="${FEATURES} -getbinpkg buildpkg binpkg-multi-instance -ipc-sandbox -network-sandbox -pid-sandbox -userpriv binpkg-signing"
 ACCEPT_LICENSE="*"
 
 BINPKG_FORMAT="gpkg"