diff --git a/net/fiche/Makefile b/net/fiche/Makefile
index c5d478378267..73c5d8cc5c3e 100644
--- a/net/fiche/Makefile
+++ b/net/fiche/Makefile
@@ -1,26 +1,26 @@
 PORTNAME=	fiche
 PORTVERSION=	0.9.1
-PORTREVISION=	3
+PORTREVISION=	4
 CATEGORIES=	net
 
 MAINTAINER=	zi@FreeBSD.org
 COMMENT=	Command line pastebin for sharing terminal output
 WWW=		https://github.com/solusipse/fiche
 
 LICENSE=	MIT
 
-USERS=		${PORTNAME}
-GROUPS=		${PORTNAME}
-
 USES=		compiler:c++11-lang
 USE_GITHUB=	yes
 GH_ACCOUNT=	solusipse
 
 USE_RC_SUBR=	${PORTNAME}
 SUB_FILES=	pkg-message
 
+USERS=		${PORTNAME}
+GROUPS=		${PORTNAME}
+
 do-install:
 	@${MKDIR} ${STAGEDIR}${PREFIX}/sbin ${STAGEDIR}${WWWDIR}
 	${INSTALL_PROGRAM} ${WRKSRC}/${PORTNAME} ${STAGEDIR}${PREFIX}/sbin
 
 .include <bsd.port.mk>
diff --git a/net/fiche/files/fiche.in b/net/fiche/files/fiche.in
index d3037a407645..4a6a36914a5d 100644
--- a/net/fiche/files/fiche.in
+++ b/net/fiche/files/fiche.in
@@ -1,46 +1,52 @@
 #!/bin/sh
 
 # PROVIDE: fiche
 # REQUIRE: NETWORKING SERVERS
 # BEFORE: DAEMON
 # KEYWORD: shutdown
 
 #
 # Add some of the following variables to /etc/rc.conf to configure fiche:
 # fiche_enable (bool):	Set to "NO" by default.
 #				Set it to "YES" to enable fiche.
 # fiche_domain (str):	Default "localhost"
 # fiche_options (str):	Additional flags Default ""
 # fiche_output (str):	Default "/usr/local/www/fiche"
 # fiche_logfile (str):	Default "/var/log/fiche/fiche.log"
+# fiche_user (str):	Default "fiche"
+# fiche_group (str):	Default "fiche"
 
 . /etc/rc.subr
 
 name="fiche"
 rcvar=fiche_enable
 
 load_rc_config $name
 
 : ${fiche_enable="NO"}
 : ${fiche_pidfile="/var/run/${name}.pid"}
 : ${fiche_options=""}
 : ${fiche_output="%%WWWDIR%%"}
 : ${fiche_domain="localhost"}
 : ${fiche_logfile="/var/log/${name}/${name}.log"}
+: ${fiche_user="fiche"}
+: ${fiche_group="fiche"}
 
 start_precmd="${name}_prestart"
 pidfile="${fiche_pidfile}"
 procname="%%PREFIX%%/sbin/fiche"
 
 command="/usr/sbin/daemon"
 command_args="-fp ${pidfile} %%PREFIX%%/sbin/fiche \
     -o ${fiche_output} \
     -d ${fiche_domain} \
     -l ${fiche_logfile} \
     ${fiche_options}"
 
 fiche_prestart() {
-	install -d -o 477 -g 477 -m 755 /var/log/${name}
+	touch ${fiche_pidfile}
+	chown ${fiche_user} ${fiche_pidfile}
+	install -d -o ${fiche_user} -g ${fiche_group} -m 755 /var/log/${name}
 }
 
 run_rc_command "$1"
diff --git a/net/fiche/files/pkg-message.in b/net/fiche/files/pkg-message.in
index 3276d0c519da..e606e1c10af4 100644
--- a/net/fiche/files/pkg-message.in
+++ b/net/fiche/files/pkg-message.in
@@ -1,19 +1,28 @@
 [
 { type: install
   message: <<EOM
 Please set the hostname of your fiche server by running:
 sysrc fiche_domain="mypaste.domain.com"
 
 You'll still need a separate webserver configured to serve the content that
 fiche produces in %%WWWDIR%%.
 
 An example nginx config may be found here:
 https://github.com/solusipse/fiche
 
 If you wish to serve the content over HTTPS, please run the following to
 ensure that fiche hands out URLs prefixed with https://:
 
 sysrc fiche_flags="-S"
 EOM
 }
+{ type: upgrade
+  maximum_version: "0.9.1_4"
+  message: <<EOM
+The service was updated to drop privileges to the user specified in $fiche_user
+(defaults to fiche) as intended, instead of running as root.
+You might need to change owner of the log file and $fiche_output,
+so that fiche can write those.
+EOM
+}
 ]