diff --git a/pillar.example b/pillar.example
index cc91871..c2bd59e 100644
--- a/pillar.example
+++ b/pillar.example
@@ -14,3 +14,5 @@ vault:
   dev_mode: true
   service:
     type: upstart
+  user: root
+  group: root
diff --git a/vault/defaults.yaml b/vault/defaults.yaml
index 4d4e712..1cdfef3 100644
--- a/vault/defaults.yaml
+++ b/vault/defaults.yaml
@@ -15,3 +15,5 @@ vault:
   dev_mode: true
   service:
     type: systemd
+  user: root
+  group: root
diff --git a/vault/files/vault_systemd.service.jinja b/vault/files/vault_systemd.service.jinja
index 7042a30..a6417b7 100644
--- a/vault/files/vault_systemd.service.jinja
+++ b/vault/files/vault_systemd.service.jinja
@@ -8,3 +8,5 @@ After=network-online.target consul.service
 EnvironmentFile=-/etc/sysconfig/vault
 Restart=on-failure
 ExecStart=/usr/local/bin/vault server {% if vault.dev_mode %}-dev{% else %} -config="/etc/vault/config/server.hcl"{% endif %}
+User={{ vault.user }}
+Group={{ vault.group }}
diff --git a/vault/init.sls b/vault/init.sls
index 045d200..6e4958d 100644
--- a/vault/init.sls
+++ b/vault/init.sls
@@ -13,8 +13,14 @@ download vault:
 
 install vault:
   cmd.run:
-    - name:  unzip /tmp/vault.zip -d /usr/local/bin &&  chmod 0755 /usr/local/bin/vault &&  chown root:root /usr/local/bin/vault
+    - name: unzip /tmp/vault.zip -d /usr/local/bin && chmod 0755 /usr/local/bin/vault && chown root:root /usr/local/bin/vault
     - require:
       - cmd: download vault
       - pkg: unzip
     - unless: test -e /usr/local/bin/vault
+
+vault set cap mlock:
+  cmd.run:
+    - name: "setcap cap_ipc_lock=+ep /usr/local/bin/vault"
+    - onchanges:
+      - cmd: install vault