Ensure runtime provisioning scripts get run as root