diff --git a/.github/tests/images.json b/.github/tests/images.json
index 3baf2e1..d351337 100644
--- a/.github/tests/images.json
+++ b/.github/tests/images.json
@@ -4,6 +4,11 @@
       "query": "tests.bash.image",
       "filter": "LATESTSHA",
       "sort-flags": []
+    },
+    {
+      "query": "chown.image",
+      "filter": "LATESTSHA",
+      "sort-flags": []
     }
   ],
   "spire-agent/values.yaml": [
diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md
index bbf2094..ea7f252 100644
--- a/charts/spire/charts/spire-server/README.md
+++ b/charts/spire/charts/spire-server/README.md
@@ -393,6 +393,11 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
 | `customPlugins.nodeAttestor`               | Custom plugins of type NodeAttestor are configured here                                                                                                                                                                                | `{}`                                                                             |
 | `customPlugins.upstreamAuthority`          | Custom plugins of type upstreamAuthority are configured here                                                                                                                                                                           | `{}`                                                                             |
 | `customPlugins.notifier`                   | Custom plugins of type notifier are configured here                                                                                                                                                                                    | `{}`                                                                             |
+| `chown.image.registry`                     | The OCI registry to pull the image from                                                                                                                                                                                                | `cgr.dev`                                                                        |
+| `chown.image.repository`                   | The repository within the registry                                                                                                                                                                                                     | `chainguard/bash`                                                                |
+| `chown.image.pullPolicy`                   | The image pull policy                                                                                                                                                                                                                  | `Always`                                                                         |
+| `chown.image.tag`                          | Overrides the image tag whose default is the chart appVersion                                                                                                                                                                          | `latest@sha256:27dc752a2ebacd10571c4045d3e1732f4bbb764446373ac85626602b69132776` |
+| `chown.resources`                          | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/                                                                                                                           | `{}`                                                                             |
 | `experimental.enabled`                     | Allow configuration of experimental features                                                                                                                                                                                           | `false`                                                                          |
 | `experimental.cacheReloadInterval`         | The amount of time between two reloads of the in-memory entry cache.                                                                                                                                                                   | `5s`                                                                             |
 | `experimental.eventsBasedCache`            | Use events to update the cache with what's changed since the last update.                                                                                                                                                              | `false`                                                                          |
diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl
index 0b3fb0f..5674c5c 100644
--- a/charts/spire/charts/spire-server/templates/_helpers.tpl
+++ b/charts/spire/charts/spire-server/templates/_helpers.tpl
@@ -318,3 +318,17 @@ subjects:
   namespace: {{ include "spire-server.namespace" . }}
 {{-   end }}
 {{- end }}
+
+{{- define "spire-server.podSecurityContext" -}}
+{{-   $podSecurityContext := include "spire-lib.podsecuritycontext" . | fromYaml }}
+{{-   $openshift := ((.Values).global).openshift | default false }}
+{{-   if not $openshift }}
+{{-     if not (hasKey $podSecurityContext "runAsUser") }}
+{{-       $_ := set $podSecurityContext "runAsUser" 1000 }}
+{{-     end }}
+{{-     if not (hasKey $podSecurityContext "runAsGroup") }}
+{{-       $_ := set $podSecurityContext "runAsGroup" 1000 }}
+{{-     end }}
+{{-   end }}
+{{-   toYaml $podSecurityContext }}
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/server-resource.yaml b/charts/spire/charts/spire-server/templates/server-resource.yaml
index d309109..8e3ecc7 100644
--- a/charts/spire/charts/spire-server/templates/server-resource.yaml
+++ b/charts/spire/charts/spire-server/templates/server-resource.yaml
@@ -1,3 +1,6 @@
+{{- $rawPodSecurityContext := fromYaml (include "spire-lib.podsecuritycontext" .) }}
+{{- $podSecurityContext := fromYaml (include "spire-server.podSecurityContext" .) }}
+{{- $needsChown := and (not (hasKey $rawPodSecurityContext "runAsUser")) (not (dig "openshift" false .Values.global)) }}
 {{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
 {{- $configSum2 := (include (print $.Template.BasePath "/secret.yaml") . | sha256sum) }}
 {{- $configSum3 := (include (print $.Template.BasePath "/controller-manager-configmap.yaml") . | sha256sum) }}
@@ -76,9 +79,9 @@ spec:
       serviceAccountName: {{ include "spire-server.serviceAccountName" . }}
       shareProcessNamespace: true
       securityContext:
-        {{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
+        {{- $podSecurityContext | toYaml | nindent 8 }}
       {{- include "spire-lib.default_cluster_priority_class_name" . | nindent 6 }}
-      {{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) .Values.nodeAttestor.tpmDirect.enabled }}
+      {{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) .Values.nodeAttestor.tpmDirect.enabled $needsChown }}
       initContainers:
         {{- if .Values.nodeAttestor.tpmDirect.enabled }}
         - name: init-tpm-direct
@@ -100,6 +103,23 @@ spec:
               mountPath: /run/spire/data
           imagePullPolicy: {{ .Values.nodeAttestor.tpmDirect.image.pullPolicy }}
       {{- end }}
+      {{- if $needsChown }}
+        - name: chown
+          image: {{ template "spire-lib.image" (dict "image" .Values.chown.image "global" .Values.global) }}
+          imagePullPolicy: {{ .Values.chown.image.pullPolicy }}
+          command: ["bash", "-c"]
+          args:
+            - |
+              chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.runAsGroup }} /var/lib/spire
+          resources:
+            {{- toYaml .Values.chown.resources | nindent 12 }}
+          volumeMounts:
+            - name: spire-data
+              mountPath: /var/lib/spire
+          securityContext:
+            runAsUser: 0
+            runAsGroup: 0
+      {{- end }}
       {{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create }}
         - name: wait
           securityContext:
diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml
index d129c0f..ef9faca 100644
--- a/charts/spire/charts/spire-server/values.yaml
+++ b/charts/spire/charts/spire-server/values.yaml
@@ -990,6 +990,22 @@ customPlugins:
   upstreamAuthority: {}
   notifier: {}
 
+# When upgrading from a previous version, sometimes we need to change the user and requires updating permissions.
+chown:
+  ## @param chown.image.registry The OCI registry to pull the image from
+  ## @param chown.image.repository The repository within the registry
+  ## @param chown.image.pullPolicy The image pull policy
+  ## @param chown.image.tag Overrides the image tag whose default is the chart appVersion
+  ##
+  image:
+    registry: cgr.dev
+    repository: chainguard/bash
+    pullPolicy: Always
+    tag: latest@sha256:27dc752a2ebacd10571c4045d3e1732f4bbb764446373ac85626602b69132776
+
+  ## @param chown.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+  resources: {}
+
 experimental:
   ## @param experimental.enabled Allow configuration of experimental features
   enabled: false