diff --git a/ansible/files/supabase_admin_agent_config/supabase-admin-agent.sudoers.conf b/ansible/files/supabase_admin_agent_config/supabase-admin-agent.sudoers.conf
index df65f11370..81a4bbd259 100644
--- a/ansible/files/supabase_admin_agent_config/supabase-admin-agent.sudoers.conf
+++ b/ansible/files/supabase_admin_agent_config/supabase-admin-agent.sudoers.conf
@@ -1,2 +1,4 @@
 %supabase-admin-agent ALL= NOPASSWD: /usr/bin/salt-call
 %supabase-admin-agent ALL= NOPASSWD: /usr/bin/gpg --homedir /etc/salt/gpgkeys --import, /usr/bin/gpg --homedir /etc/salt/gpgkeys --list-secret-keys *
+# supabase-admin-agent needs sudo here since /etc/pgbackrest/conf.d is root/adminapi-only, but the salt subcommand runs unprivileged (INDATA-996)
+%supabase-admin-agent ALL= NOPASSWD: /opt/supabase-admin-agent/supabase-admin-agent pgbackrest reconcile
diff --git a/ansible/tasks/internal/supabase-admin-agent.yml b/ansible/tasks/internal/supabase-admin-agent.yml
index 69e7861291..b75ec9512d 100644
--- a/ansible/tasks/internal/supabase-admin-agent.yml
+++ b/ansible/tasks/internal/supabase-admin-agent.yml
@@ -15,7 +15,9 @@
 - name: supabase-admin-agent - config dir
   file:
     path: /opt/supabase-admin-agent
-    owner: supabase-admin-agent
+    # /opt/supabase-admin-agent (dir, unpacked binary, symlink) is all root-owned so the service account can run it via sudoers but never modify it (INDATA-996)
+    owner: root
+    group: root
     state: directory
 
 - name: supabase-admin-agent - gpg dir
@@ -90,7 +92,8 @@
     remote_src: yes
     src: /tmp/supabase-admin-agent.tar.gz
     dest: /opt/supabase-admin-agent/
-    owner: supabase-admin-agent
+    owner: root
+    group: root
     extra_opts:
       - --strip-components=1
 
@@ -99,7 +102,8 @@
     path: /opt/supabase-admin-agent/supabase-admin-agent
     src: "/opt/supabase-admin-agent/supabase-admin-agent-linux-{{ arch }}"
     state: link
-    owner: supabase-admin-agent
+    owner: root
+    group: root
     mode: "0755"
     force: yes