diff --git a/backend/windmill-worker/nsjail/run.bun.config.proto b/backend/windmill-worker/nsjail/run.bun.config.proto
index b245ea2f2c..45afd80108 100644
--- a/backend/windmill-worker/nsjail/run.bun.config.proto
+++ b/backend/windmill-worker/nsjail/run.bun.config.proto
@@ -15,17 +15,7 @@ clone_newnet: false
 clone_newuser: {CLONE_NEWUSER}
 clone_newcgroup: false
 
-uidmap {
-    inside_id: "1000"
-    outside_id: ""
-    count: 1
-}
-
-gidmap {
-    inside_id: "1000"
-    outside_id: ""
-    count: 1
-}
+{UIDGIDMAP}
 
 skip_setsid: true
 keep_caps: false
diff --git a/backend/windmill-worker/src/bun_executor.rs b/backend/windmill-worker/src/bun_executor.rs
index 8f787168ac..7cee3ed110 100644
--- a/backend/windmill-worker/src/bun_executor.rs
+++ b/backend/windmill-worker/src/bun_executor.rs
@@ -2079,6 +2079,9 @@ try {{
                 .replace("{LANG}", if annotation.nodejs { "nodejs" } else { "bun" })
                 .replace("{JOB_DIR}", job_dir)
                 .replace("{CLONE_NEWUSER}", &(!*DISABLE_NUSER).to_string())
+                .replace("{UIDGIDMAP}", if *DISABLE_NUSER { "" } else {
+                    "uidmap {\n    inside_id: \"1000\"\n    outside_id: \"\"\n    count: 1\n}\n\ngidmap {\n    inside_id: \"1000\"\n    outside_id: \"\"\n    count: 1\n}"
+                })
                 .replace(
                     "{SHARED_MOUNT}",
                     &shared_mount.replace(