diff --git a/install_files/securedrop-config-focal/opt/securedrop/reboot-flag b/install_files/securedrop-config-focal/opt/securedrop/reboot-flag
index 469c699ed5..4322078401 100644
--- a/install_files/securedrop-config-focal/opt/securedrop/reboot-flag
+++ b/install_files/securedrop-config-focal/opt/securedrop/reboot-flag
@@ -1,4 +1,4 @@
 # The purpose of this cron is to drop the reboot-required flag every 12 hours
 # to ensure the system is rebooted nightly, regardless of updates being installed
 # or not.
-* */12 * * * touch /var/run/reboot-required
+0 */12 * * * root touch /var/run/reboot-required
diff --git a/molecule/testinfra/common/test_automatic_updates.py b/molecule/testinfra/common/test_automatic_updates.py
index 78ca48fa41..266f8fb35d 100644
--- a/molecule/testinfra/common/test_automatic_updates.py
+++ b/molecule/testinfra/common/test_automatic_updates.py
@@ -291,7 +291,7 @@ def test_reboot_required_cron(host):
         assert f.user == "root"
         assert f.mode == 0o644
 
-        line = '^{}$'.format(re.escape("* */12 * * * touch /var/run/reboot-required"))
+        line = '^{}$'.format(re.escape("0 */12 * * * root touch /var/run/reboot-required"))
         assert f.contains(line)