diff --git a/app/tests/test_rdp_module_boot_setup.py b/app/tests/test_rdp_module_boot_setup.py
index 8cb8c8b..bb29820 100644
--- a/app/tests/test_rdp_module_boot_setup.py
+++ b/app/tests/test_rdp_module_boot_setup.py
@@ -52,9 +52,17 @@ class RdpModuleBootSetupTests(unittest.TestCase):
         self.assertIn('echo "grdctl command timed out: $*" >&2', self.setup_service)
         self.assertIn('echo "grdctl command failed (exit $rc): $*" >&2', self.setup_service)
 
-    def test_setup_runs_grdctl_as_gnome_remote_desktop_user(self):
-        self.assertIn("runuser -u gnome-remote-desktop -- \\", self.setup_service)
+    def test_setup_runs_grdctl_directly_as_root(self):
+        # The oneshot service already runs as root; system-mode grdctl must be
+        # invoked directly so it does not attempt pkexec authorisation.
         self.assertIn('grdctl --system "$@"', self.setup_service)
+        self.assertNotIn("runuser", self.setup_service)
+        self.assertNotIn("pkexec", self.setup_service)
+        self.assertNotIn("sudo", self.setup_service)
+
+    def test_privilege_escalation_packages_absent_from_setup_path(self):
+        self.assertNotIn("pkgs.polkit", self.setup_service)
+        self.assertNotIn("pkgs.util-linux", self.setup_service)
 
     def test_hub_files_are_the_source_of_truth_for_username_and_password(self):
         self.assertIn('DEFAULT_USERNAME="sovran"', self.setup_service)
diff --git a/modules/rdp.nix b/modules/rdp.nix
index 2499491..c658631 100644
--- a/modules/rdp.nix
+++ b/modules/rdp.nix
@@ -46,9 +46,7 @@ lib.mkIf config.sovran_systemsOS.features.rdp {
       pkgs.gnome-remote-desktop
       pkgs.hostname
       pkgs.openssl
-      pkgs.polkit
       pkgs.systemd
-      pkgs.util-linux
     ];
     script = ''
       set -euo pipefail
@@ -64,7 +62,6 @@ lib.mkIf config.sovran_systemsOS.features.rdp {
         local rc=0
 
         if timeout --kill-after=5s 10s \
-          runuser -u gnome-remote-desktop -- \
           grdctl --system "$@"; then
           return 0
         else