diff --git a/roles/koji_builder/templates/builders/site-defaults.cfg b/roles/koji_builder/templates/builders/site-defaults.cfg
index efe8ac2ff9..593bf758af 100644
--- a/roles/koji_builder/templates/builders/site-defaults.cfg
+++ b/roles/koji_builder/templates/builders/site-defaults.cfg
@@ -8,3 +8,8 @@ config_opts['environment']['LANG'] = 'C.UTF-8'
 config_opts['use_bootstrap'] = True
 config_opts['yum_install_command'] += " -x devtoolset*"
 config_opts['dnf_warning'] = False
+{% if 'runroot' in group_names %}
+# We need to set this to get ostree_installer runroot jobs working
+# https://bugzilla.redhat.com/show_bug.cgi?id=2123812
+config_opts['nspawn_args'] += ['--capability=cap_mac_admin']
+{% endif %}