diff --git a/dockerFiles/marklogic-server-ubi-rootless:base b/dockerFiles/marklogic-server-ubi-rootless:base
index b9f7db3a..04c1869e 100644
--- a/dockerFiles/marklogic-server-ubi-rootless:base
+++ b/dockerFiles/marklogic-server-ubi-rootless:base
@@ -175,6 +175,13 @@ RUN for package in vim-minimal cups-client cups-libs tar avahi-libs binutils lib
     do rpm -e --nodeps $package || true; \
     done;
 
+RUN for file in /usr/sbin/unix_chkpwd /usr/bin/su /usr/bin/umount; do \
+        if [ -e "$file" ]; then chmod u-s "$file"; fi; \
+    done \
+    && for file in /usr/bin/write /var/lib/tpm2-tss/system/keystore; do \
+        if [ -e "$file" ]; then chmod g-s "$file"; fi; \
+    done
+
 ###############################################################
 # expose MarkLogic server ports
 ###############################################################
diff --git a/dockerFiles/marklogic-server-ubi9-arm:base b/dockerFiles/marklogic-server-ubi9-arm:base
index 06487086..c05e53f4 100644
--- a/dockerFiles/marklogic-server-ubi9-arm:base
+++ b/dockerFiles/marklogic-server-ubi9-arm:base
@@ -120,6 +120,13 @@ RUN for package in vim-minimal cups-client cups-libs tar avahi-libs binutils lib
     do rpm -e --nodeps $package || true; \
     done;
 
+RUN for file in /usr/sbin/unix_chkpwd /usr/bin/su /usr/bin/umount; do \
+        if [ -e "$file" ]; then chmod u-s "$file"; fi; \
+    done \
+    && for file in /usr/bin/write /var/lib/tpm2-tss/system/keystore; do \
+        if [ -e "$file" ]; then chmod g-s "$file"; fi; \
+    done
+
 ###############################################################
 # expose MarkLogic server ports
 ###############################################################
diff --git a/dockerFiles/marklogic-server-ubi:base b/dockerFiles/marklogic-server-ubi:base
index 65e723c7..5139129c 100644
--- a/dockerFiles/marklogic-server-ubi:base
+++ b/dockerFiles/marklogic-server-ubi:base
@@ -121,6 +121,13 @@ RUN for package in vim-minimal cups-client cups-libs tar avahi-libs binutils lib
     do rpm -e --nodeps $package || true; \
     done;
 
+RUN for file in /usr/sbin/unix_chkpwd /usr/bin/su /usr/bin/umount; do \
+        if [ -e "$file" ]; then chmod u-s "$file"; fi; \
+    done \
+    && for file in /usr/bin/write /var/lib/tpm2-tss/system/keystore; do \
+        if [ -e "$file" ]; then chmod g-s "$file"; fi; \
+    done
+
 ###############################################################
 # expose MarkLogic server ports
 ###############################################################