diff --git a/Python/etc/crans/secrets/secrets.py b/Python/etc/crans/secrets/secrets.py
index fc513c3..19cdedf 100644
--- a/Python/etc/crans/secrets/secrets.py
+++ b/Python/etc/crans/secrets/secrets.py
@@ -1,4 +1,7 @@
 info["perms"] = 0440
-info["owner"] = "respbats"
+if has("users"):
+    info["owner"] = "respbats"
+else:
+    info["owner"] = "root"
 info["group"] = "adm"
 print file("/etc/crans/secrets/secrets.py").read()
diff --git a/Rules/rules.xml b/Rules/rules.xml
index 6cc5ee8..d0f9d6d 100644
--- a/Rules/rules.xml
+++ b/Rules/rules.xml
@@ -26,7 +26,12 @@
 	  timing="post" when="modified" status="check"
 	  command="cat /etc/crans/apt-keys/*.asc | apt-key add -"/>
 
-  <Directory name="/etc/crans/secrets" owner="respbats" group="adm" perms="0550"/>
+  <Group name="users">
+    <Directory name="/etc/crans/secrets" owner="respbats" group="adm" perms="0550"/>
+  </Group>
+  <Group name="users" negate="true">
+    <Directory name="/etc/crans/secrets" owner="root" group="adm" perms="0550"/>
+  </Group>
 
   <Service type="deb" name="bcfg2" status="on"/>
   <Service type="deb" name="bcfg2-server" status="on"/>