diff --git a/docs/release-notes.md b/docs/release-notes.md
index e4015a63f2..302e5b59e0 100644
--- a/docs/release-notes.md
+++ b/docs/release-notes.md
@@ -14,6 +14,8 @@ nav_order: 9
 
 ### Bug fixes
 
+- Drop supplementary groups when dropping privileges to write files as a user ([#2242](https://github.com/coreos/ignition/issues/2242))
+
 
 ## Ignition 2.27.0 (2026-08-26)
 
diff --git a/internal/as_user/as_user.c b/internal/as_user/as_user.c
index f84b464803..386f998ba7 100644
--- a/internal/as_user/as_user.c
+++ b/internal/as_user/as_user.c
@@ -15,6 +15,7 @@
 #define _GNU_SOURCE
 #include <errno.h>
 #include <fcntl.h>
+#include <grp.h>
 #include <sched.h>
 #include <signal.h>
 #include <stdio.h>
@@ -54,7 +55,9 @@ typedef struct au_thread_ctxt {
 	int		err;
 } au_thread_ctxt_t;
 
-/* set_eids() sets the effective gid and uid of the calling thread to ids */
+/* set_eids() drops the supplementary groups and sets the effective gid and
+ * uid of the calling thread to ids
+ */
 static int set_eids(au_ids_t *ids) {
 	uid_t	cu;
 	gid_t	cg;
@@ -64,6 +67,14 @@ static int set_eids(au_ids_t *ids) {
 	cu = geteuid();
 	cg = getegid();
 
+	/* Drop the supplementary groups inherited from the caller before
+	 * relinquishing the gid and uid, while we still have the privilege
+	 * required to do so.  Otherwise the thread would keep root's group
+	 * memberships while acting as the target user.
+	 */
+	if(setgroups(0, NULL) == -1)
+		return -1;
+
 	if(cg != ids->gid && setregid(-1, ids->gid) == -1)
 		return -1;