diff --git a/Makefile b/Makefile
index 9a793eb..cbd4e0d 100644
--- a/Makefile
+++ b/Makefile
@@ -218,7 +218,7 @@ install-common: install-doc
 		misc/20_org.mate.NotificationDaemon.qubes.gschema.override \
 		misc/20_org.gnome.desktop.wm.preferences.qubes.gschema.override \
 		$(DESTDIR)/usr/share/glib-2.0/schemas/
-	install -g user -m 2775 -d $(DESTDIR)/var/lib/qubes/dom0-updates
+	install -m 2775 -d $(DESTDIR)/var/lib/qubes/dom0-updates
 	install -D -m 0644 misc/qubes-master-key.asc $(DESTDIR)/usr/share/qubes/qubes-master-key.asc
 	install misc/resize-rootfs $(DESTDIR)$(LIBDIR)/qubes/
 
diff --git a/archlinux/PKGBUILD.install b/archlinux/PKGBUILD.install
index 3438c17..1d5c357 100644
--- a/archlinux/PKGBUILD.install
+++ b/archlinux/PKGBUILD.install
@@ -324,6 +324,8 @@ post_install() {
         cp /etc/init/serial.conf /var/lib/qubes/serial.orig
     fi
 
+    chgrp user /var/lib/qubes/dom0-updates
+
     # Remove most of the udev scripts to speed up the VM boot time
     # Just leave the xen* scripts, that are needed if this VM was
     # ever used as a net backend (e.g. as a VPN domain in the future)
diff --git a/debian/qubes-core-agent.postinst b/debian/qubes-core-agent.postinst
index c571a8f..64ae85a 100755
--- a/debian/qubes-core-agent.postinst
+++ b/debian/qubes-core-agent.postinst
@@ -145,6 +145,8 @@ case "${1}" in
         fi
         systemctl reenable haveged
 
+        chgrp user /var/lib/qubes/dom0-updates
+
         debug "UPDATE..."
         # disable some Upstart services
         for init in plymouth-shutdown \
diff --git a/rpm_spec/core-agent.spec.in b/rpm_spec/core-agent.spec.in
index d300694..5d4d83e 100644
--- a/rpm_spec/core-agent.spec.in
+++ b/rpm_spec/core-agent.spec.in
@@ -267,7 +267,7 @@ Thunar support for Qubes VM tools
 
 %build
 for dir in qubes-rpc qrexec misc; do
-  (cd $dir; make)
+  make -C $dir BACKEND_VMM=@BACKEND_VMM@
 done
 make -C doc manpages
 
@@ -329,6 +329,7 @@ for F in plymouth-shutdown prefdm splash-manager start-ttys tty ; do
 	fi
 done
 
+chgrp user /var/lib/qubes/dom0-updates
 
 # Remove old firmware updates link
 if [ -L /lib/firmware/updates ]; then