diff --git a/Containerfile.alpine b/Containerfile.alpine
index e51ff4c7..ddfd665a 100644
--- a/Containerfile.alpine
+++ b/Containerfile.alpine
@@ -67,9 +67,6 @@ ARG RUBYGEM_R10K=5.0.3
 # renovate: datasource=rubygems depName=rugged
 ARG RUBYGEM_RUGGED=1.9.0
 
-ARG OPENVOX_USER_UID=64604
-ARG OPENVOX_USER_GID=64604
-
 # renovate: datasource=custom.voxpupuli-artifacts depName=openvox-server
 ARG OPENVOXSERVER_VERSION=8.15.1
 
@@ -102,8 +99,6 @@ ENV AUTOSIGN=true \
     OPENVOX_REPORTS="puppetdb" \
     OPENVOX_STORECONFIGS_BACKEND="puppetdb" \
     OPENVOX_STORECONFIGS=true \
-    OPENVOX_USER_UID=${OPENVOX_USER_UID} \
-    OPENVOX_USER_GID=${OPENVOX_USER_GID} \
     OPENVOXDB_SERVER_URLS=https://openvoxdb:8081 \
     OPENVOXSERVER_ENABLE_ENV_CACHE_DEL_API=true \
     OPENVOXSERVER_ENVIRONMENT_TIMEOUT=unlimited \
@@ -136,7 +131,7 @@ COPY Containerfile.alpine /Containerfile
 
 RUN /prep_release_container.sh
 
-USER puppet:0
+USER 64604:0
 
 # Create a CDS archive in a stage for faster class loading.
 FROM app AS cds
diff --git a/Containerfile.ubuntu b/Containerfile.ubuntu
index b077ac33..c32ad630 100644
--- a/Containerfile.ubuntu
+++ b/Containerfile.ubuntu
@@ -76,9 +76,6 @@ ARG RUBYGEM_R10K=5.0.3
 # renovate: datasource=rubygems depName=rugged
 ARG RUBYGEM_RUGGED=1.9.0
 
-ARG OPENVOX_USER_UID=64604
-ARG OPENVOX_USER_GID=64604
-
 # renovate: datasource=custom.voxpupuli-artifacts depName=openvox-server
 ARG OPENVOXSERVER_VERSION=8.15.1
 
@@ -111,8 +108,6 @@ ENV AUTOSIGN=true \
     OPENVOX_REPORTS="puppetdb" \
     OPENVOX_STORECONFIGS_BACKEND="puppetdb" \
     OPENVOX_STORECONFIGS=true \
-    OPENVOX_USER_UID=${OPENVOX_USER_UID} \
-    OPENVOX_USER_GID=${OPENVOX_USER_GID} \
     OPENVOXDB_SERVER_URLS=https://openvoxdb:8081 \
     OPENVOXSERVER_ENABLE_ENV_CACHE_DEL_API=true \
     OPENVOXSERVER_ENVIRONMENT_TIMEOUT=unlimited \
@@ -145,7 +140,7 @@ COPY Containerfile.ubuntu /Containerfile
 
 RUN /prep_release_container.sh
 
-USER puppet:0
+USER 64604:0
 
 # Create a CDS archive in a stage for faster class loading.
 FROM app AS cds
diff --git a/MIGRATION.md b/MIGRATION.md
index 062ef402..3e402401 100644
--- a/MIGRATION.md
+++ b/MIGRATION.md
@@ -1,11 +1,14 @@
 # Migrations
 
-## V8.12.0 -> V8.13.0
+## Coming from a fixed UID release 
 
-UID is changed from 1001 on alpine and 999 on ubuntu to 64604.
-If you already deployed the containers with mounted volumes, you HAVE to change the ownership of these volumes and the files underneath.
+The container runs with **group 0** and works under **any UID**. File access is granted exclusively through group 0, and the UID of files on mounted volumes does not matter. There is no `puppet` service account in the image anymore. 
+
+For existing volumes, run once:
 
 ```bash
-chown -R 64604:0 /path/to/ca_mountpoint
-chown -R 64604:0 /path/to/ssl_mountpoint
+chgrp -R 0 [PATH TO THE VOLUME]
+chmod -R g+rwX [PATH TO THE VOLUME]
 ```
+
+On Kubernetes/OpenShift using `fsGroup: 0` in the pod securityContext can be used to achieve the same.
diff --git a/README.md b/README.md
index ba31cac8..3694068b 100644
--- a/README.md
+++ b/README.md
@@ -183,16 +183,20 @@ services:
 
 #### Rootless Podman
 
-When using rootless Podman, the OpenVox Server process runs directly as the non-root `puppet` user (UID 64604) with the root group (GID 0).
-This can lead to permission issues with bind mount volumes, which you may want to use for the OpenVox SSL and CA directories. For example:
+The container runs with the root group (GID 0) and works under any UID. Access to mounted volumes is granted through group 0 only, the UID of the files does not matter. Prepare bind mounts once using:
+
+```shell
+chgrp -R 0 <dir> && chmod -R g+rwX <dir>
+```
+
+For example for the OpenVox SSL and CA directories:
 
 ```shell
 -v ./openvoxserver-ssl:/etc/puppetlabs/puppet/ssl
 -v ./openvoxserver-ca:/etc/puppetlabs/puppetserver/ca
 ```
 
-By default the container will attempt to correct permissions. For a large number of files it may spend a long time at "Adjusting mounted CA directory ownership". This is normal.
-If this still runs into permissions issues please check selinux and related security layers. You can relabel the host directory using the `:Z` flag:
+If you still run into permission issues please check selinux and related security layers. You can relabel the host directory using the `:Z` flag:
 
 ```shell
 -v ./openvoxserver-ca:/etc/puppetlabs/puppetserver/ca:Z
diff --git a/openvoxserver/files/container-entrypoint.d/87-ca-permissions.sh b/openvoxserver/files/container-entrypoint.d/87-ca-permissions.sh
deleted file mode 100755
index bb8312d4..00000000
--- a/openvoxserver/files/container-entrypoint.d/87-ca-permissions.sh
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/bin/bash
-
-set -e
-
-CA_DIR="/etc/puppetlabs/puppetserver/ca"
-
-# Check if CA directory is present and owned by any a different user
-if [ -d "$CA_DIR" ] && [ "$(stat -c '%u' "$CA_DIR")" != "$OPENVOX_USER_UID" ]; then
-  echo "Adjusting mounted CA directory ownership. This may take time. Please wait."
-  chown -R "$OPENVOX_USER_UID:$OPENVOX_USER_GID" "$CA_DIR" || echo "Failed to chown $CA_DIR"
-fi
diff --git a/openvoxserver/prep_release_container.sh b/openvoxserver/prep_release_container.sh
index 80e50164..2216fcfa 100755
--- a/openvoxserver/prep_release_container.sh
+++ b/openvoxserver/prep_release_container.sh
@@ -76,28 +76,14 @@ else
   rm -rf /var/lib/apt/lists/*
 fi
 
-# Create puppet user and group, and set permissions on necessary directories
-# Used for rootless execution of the container and to match permissions expected by Puppet Server
-if command -v addgroup >/dev/null 2>&1 && command -v apk >/dev/null 2>&1; then
-  addgroup -g "${OPENVOX_USER_GID}" puppet
-  adduser -G puppet -u "${OPENVOX_USER_UID}" -h /opt/puppetlabs/server/data/puppetserver -H -D -s /sbin/nologin puppet
-else
-  groupadd --gid "${OPENVOX_USER_GID}" puppet
-  useradd \
-    --gid puppet \
-    --home-dir /opt/puppetlabs/server/data/puppetserver \
-    --no-create-home \
-    --shell /usr/sbin/nologin \
-    --uid "${OPENVOX_USER_UID}" \
-    puppet
-fi
-
-chown -R puppet:puppet /etc/puppetlabs/code
-chown -R puppet:puppet /etc/puppetlabs/puppet
-chown -R puppet:puppet /etc/puppetlabs/puppetserver
-chown -R puppet:puppet /opt/puppetlabs/server/data/puppetserver
-chown -R puppet:puppet /var/log/puppetlabs/puppetserver
-chown -R puppet:puppet /var/run/puppetlabs/puppetserver
+# The container runs as UID 64604 by default, but any UID works. Everything the
+# server needs to write is root-owned with group 0 mirroring the owner permissions
+chown -R 0:0 /etc/puppetlabs/code
+chown -R 0:0 /etc/puppetlabs/puppet
+chown -R 0:0 /etc/puppetlabs/puppetserver
+chown -R 0:0 /opt/puppetlabs/server/data/puppetserver
+chown -R 0:0 /var/log/puppetlabs/puppetserver
+chown -R 0:0 /var/run/puppetlabs/puppetserver
 
 chmod 0700 /opt/puppetlabs/server/data/puppetserver/jars
 chmod 0700 /opt/puppetlabs/server/data/puppetserver/yaml
@@ -168,7 +154,6 @@ for d in /etc/puppetlabs /var/log/puppetlabs /var/run/puppetlabs /opt/puppetlabs
   chmod -R g=u "$d"
   find "$d" -type d -exec chmod g+s {} +
 done
-chown puppet /run/openvox
 
 # the foreground starting script has this check before running the server:
 # [ "$EUID" = "$(id -u ${USER})" ]