diff --git prosody/util/prosodyctl/cert.lua prosody/util/prosodyctl/cert.lua
index 02c8158..f5d7455 100644
--- prosody/util/prosodyctl/cert.lua
+++ prosody/util/prosodyctl/cert.lua
@@ -216,7 +216,7 @@ function cert_commands.import(arg)
 	end
 	local owner, group;
 	if pposix.getuid() == 0 then -- We need root to change ownership
-		owner = configmanager.get("*", "prosody_user") or "prosody";
+		owner = configmanager.get("*", "prosody_user") or "_prosody";
 		group = configmanager.get("*", "prosody_group") or owner;
 	end
 	local cm = require "core.certmanager";
diff --git prosody/util/startup.lua prosody/util/startup.lua
index ce14df7..9da0ba6 100644
--- prosody/util/startup.lua
+++ prosody/util/startup.lua
@@ -503,7 +503,7 @@ function startup.switch_user()
 		local arg_root = prosody.opts.root;
 		if prosody.current_uid == 0 and config.get("*", "run_as_root") ~= true and not arg_root then
 			-- We haz root!
-			local desired_user = config.get("*", "prosody_user") or "prosody";
+			local desired_user = config.get("*", "prosody_user") or "_prosody";
 			local desired_group = config.get("*", "prosody_group") or desired_user;
 			local ok, err = pposix.setgid(desired_group);
 			if ok then