diff --git a/.resinci.json b/.resinci.json
index 3f043722..399f1646 100644
--- a/.resinci.json
+++ b/.resinci.json
@@ -17,6 +17,7 @@
       "copyright": "Copyright 2016-2019 Balena Ltd",
       "productName": "balenaEtcher",
       "nodeGypRebuild": true,
+      "afterPack": "./afterPack.js",
       "files": [
         "generated",
         "lib/shared/catalina-sudo/sudo-askpass.osascript.js",
diff --git a/afterPack.js b/afterPack.js
new file mode 100644
index 00000000..021388f1
--- /dev/null
+++ b/afterPack.js
@@ -0,0 +1,27 @@
+'use strict'
+
+const cp = require('child_process')
+const fs = require('fs')
+const outdent = require('outdent')
+const path = require('path')
+
+exports.default = function(context) {
+  if (context.packager.platform.name !== 'linux') {
+    return
+  }
+  const scriptPath = path.join(context.appOutDir, context.packager.executableName)
+  const binPath = scriptPath + '.bin'
+  cp.execFileSync('mv', [scriptPath, binPath])
+  fs.writeFileSync(
+    scriptPath,
+    outdent`
+      #!/bin/bash
+      if [[ $EUID -ne 0 ]]; then
+        "\${BASH_SOURCE%/*}"/${context.packager.executableName}.bin "$@"
+      else
+        "\${BASH_SOURCE%/*}"/${context.packager.executableName}.bin "$@" --no-sandbox
+      fi
+    `
+  )
+  cp.execFileSync('chmod', ['+x', scriptPath])
+}
diff --git a/electron-builder.yml b/electron-builder.yml
index 9727751d..ff2d153e 100644
--- a/electron-builder.yml
+++ b/electron-builder.yml
@@ -4,6 +4,7 @@ productName: balenaEtcher
 npmRebuild: true
 nodeGypRebuild: true
 publish: null
+afterPack: "./afterPack.js"
 files:
   - generated
   - lib/shared/catalina-sudo/sudo-askpass.osascript.js