diff --git a/docker/main/rootfs/etc/s6-overlay/s6-rc.d/nginx/run b/docker/main/rootfs/etc/s6-overlay/s6-rc.d/nginx/run
index d7d70a15a7..1e1a7b334f 100755
--- a/docker/main/rootfs/etc/s6-overlay/s6-rc.d/nginx/run
+++ b/docker/main/rootfs/etc/s6-overlay/s6-rc.d/nginx/run
@@ -80,6 +80,11 @@ cp -r /usr/local/nginx/conf/. /tmp/nginx/conf/
 
 set_worker_processes
 
+# A non-root master ignores `user` and warns on every start
+if [[ "$runs_as_root" -eq 0 ]]; then
+    sed -i '/^user root;$/d' /tmp/nginx/conf/nginx.conf
+fi
+
 # TLS certs: user-mounted certs at /etc/letsencrypt/live/frigate (documented
 # contract) always win; otherwise fall back to a self-signed cert persisted in
 # /config/tls, which stays writable under a read-only root filesystem.
diff --git a/docker/main/rootfs/usr/local/nginx/conf/nginx.conf b/docker/main/rootfs/usr/local/nginx/conf/nginx.conf
index cf9a567216..f6d060d181 100644
--- a/docker/main/rootfs/usr/local/nginx/conf/nginx.conf
+++ b/docker/main/rootfs/usr/local/nginx/conf/nginx.conf
@@ -2,7 +2,7 @@
 # file, all other path directives follow --prefix and must stay absolute.
 
 daemon off;
-# ignored by a non-root master; keeps workers root under FRIGATE_RUN_AS_ROOT
+# keeps workers root under FRIGATE_RUN_AS_ROOT; the run script strips it otherwise
 user root;
 worker_processes auto;