diff --git a/package/confd/confd.conf b/package/confd/confd.conf
index f961896c..36eaf683 100644
--- a/package/confd/confd.conf
+++ b/package/confd/confd.conf
@@ -10,10 +10,11 @@ run name:error :1 log:console norestart if:<run/bootstrap/failure> \
 service name:confd log <run/bootstrap/success> \
 	[S12345] sysrepo-plugind -f -p /run/confd.pid -n -- Configuration daemon
 
-# Bootstrap system with startup-config
+# Bootstrap system with startup-config, ensure correct ownership
 run name:startup log:prio:user.notice norestart <pid/confd> \
 	[S] /usr/libexec/confd/load startup-config \
 	-- Loading startup-config
+task chown admin:wheel /cfg/startup-config.cfg --
 
 # Run if loading startup-config fails for some reason
 run name:failure log:prio:user.critical norestart <pid/confd> if:<run/startup/failure> \
diff --git a/src/confd/bin/bootstrap b/src/confd/bin/bootstrap
index 5f6931bf..7e0fe87b 100755
--- a/src/confd/bin/bootstrap
+++ b/src/confd/bin/bootstrap
@@ -255,7 +255,6 @@ chgrp wheel /cfg
 chmod g+w   /cfg
 if [ ! -f "$STARTUP_CFG" ]; then
     sysrepocfg -f json -X"$STARTUP_CFG"
-    chown admin:wheel "$STARTUP_CFG"
 fi
 
 # Clear running-config so we can load startup in the next step