I'm not sure why we're changing the group to root here (and in a few other places), but not in all places. This is inconsistent: we should either keep the bind group everywhere or the root group everywhere (as long as the group permission is read-only, obviously)