diff --git a/init/src/main.rs b/init/src/main.rs
index 8b7ba87..c0b93e9 100644
--- a/init/src/main.rs
+++ b/init/src/main.rs
@@ -353,6 +353,9 @@ fn exec_command(argv: &[String], user: Option<UserSpec>) -> ! {
     let c_prog = cstrings[0].clone();
     let c_refs: Vec<&CString> = cstrings.iter().collect();
 
+    // If UserSpec is 0:0, don't fork.
+    let user = user.filter(|u| !u.uid.is_root() || u.gid != Gid::from_raw(0));
+
     match user {
         None => {
             // No privilege drop: exec directly, PID 1 becomes the command.
@@ -362,6 +365,7 @@ fn exec_command(argv: &[String], user: Option<UserSpec>) -> ! {
             std::process::exit(1);
         }
         Some(user) => {
+            warn(&format!("dropping privileges to {}:{}", user.uid, user.gid));
             // Drop privileges in a child so PID 1 (root) can poweroff afterwards.
             match unsafe { fork() } {
                 Ok(ForkResult::Child) => {