diff --git a/minecraft-java/module.yaml b/minecraft-java/module.yaml
index c1d583b..2d422c1 100644
--- a/minecraft-java/module.yaml
+++ b/minecraft-java/module.yaml
@@ -2,7 +2,7 @@
 apiVersion: gameplane.local/module/v1
 name: minecraft-java
 displayName: Minecraft (Java Edition)
-version: 2.9.0
+version: 2.9.1
 game: minecraft-java
 categories: [Sandbox, Survival, Building, Modded, Creative]
 summary: Vanilla / Paper / Spigot / Bukkit / Purpur / Forge / NeoForge / Fabric / Quilt servers (itzg/minecraft-server) with a version+loader picker spanning 1.16.5–latest, per-loader mod volumes, and in-app Modrinth browse.
diff --git a/minecraft-java/template.yaml b/minecraft-java/template.yaml
index 083f722..af9b9b6 100644
--- a/minecraft-java/template.yaml
+++ b/minecraft-java/template.yaml
@@ -23,7 +23,7 @@ spec:
   displayName: Minecraft (Java Edition)
   game: minecraft-java
   # Kept in lockstep with module.yaml's bundle version from 2.5.0 onward.
-  version: 2.9.0
+  version: 2.9.1
   categories: [Sandbox, Survival, Building, Modded, Creative]
   # Brand color the dashboard tints this game's icon/accents with.
   accentColor: "#5b9a3e"
@@ -39,6 +39,12 @@ spec:
   # release / Java runtime — TYPE and VERSION env select the software.
   image: itzg/minecraft-server:java21@sha256:f71555873bdaa6f4b663563de58678cca334bc51bdfbe548f7958ee9f516cf4a
 
+  # Start as the image minecraft user to bypass the gosu privilege drop.
+  security:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+
   # INIT_MEMORY/MAX_MEMORY are configSchema fields (schema-resolved config
   # overrides template env on name collisions), so the JVM heap is visible
   # and adjustable in the wizard next to the container memory limit instead