add nonpriv pup run after autosign setup