diff --git a/NEWS.md b/NEWS.md
index 649b36ea..3aa1dc78 100644
--- a/NEWS.md
+++ b/NEWS.md
@@ -50,6 +50,10 @@
 
 + `use_git()` is now at the bottom of 01_dev.R ((#1094, @ilyaZar))
 
++ `golem::add_dockerfile_with_renv_*()` set "rstudio" as default USER in Dockerfile to avoid launching app as root
+
++ It is now easier to modify the renv.config.pak.enabled parameter in the Dockerfile generated by `golem::add_dockerfile_with_renv_*()` functions.
+
 ## Bug fix
 
 + `use_{internal,external}_XXX_file()` function family works with default missing `name` argument (#1060, @ilyaZar)
diff --git a/R/add_dockerfiles_renv.R b/R/add_dockerfiles_renv.R
index 59633a02..75e5f645 100644
--- a/R/add_dockerfiles_renv.R
+++ b/R/add_dockerfiles_renv.R
@@ -111,7 +111,7 @@ add_dockerfile_with_renv_ <- function(
 
   my_dock$COPY(basename(lockfile), "renv.lock")
 
-  my_dock$RUN("R -e 'renv::restore()'")
+  my_dock$RUN("R -e 'options(renv.config.pak.enabled = FALSE);renv::restore()'")
 
   if (update_tar_gz) {
     old_version <- list.files(
@@ -202,6 +202,7 @@ add_dockerfile_with_renv_ <- function(
 #' @param document boolean. If TRUE (by default), DESCRIPTION file is updated using [attachment::att_amend_desc()] before creating the renv.lock file
 #' @param dockerfile_cmd What is the CMD to add to the Dockerfile. If NULL, the default,
 #' the CMD will be `R -e "options('shiny.port'={port},shiny.host='{host}');library({appname});{appname}::run_app()\`.
+#' @param user Name of the user to specify in the Dockerfile with the USER instruction. Default is `rstudio`, if set to `NULL` no the user from the FROM image is used.
 #' @param ... Other arguments to pass to [renv::snapshot()].
 #' @inheritParams add_dockerfile
 #' @rdname dockerfiles
@@ -223,6 +224,7 @@ add_dockerfile_with_renv <- function(
   extra_sysreqs = NULL,
   update_tar_gz = TRUE,
   dockerfile_cmd = NULL,
+  user = "rstudio",
   ...
 ) {
   base_dock <- add_dockerfile_with_renv_(
@@ -243,6 +245,9 @@ add_dockerfile_with_renv <- function(
   if (!is.null(port)) {
     base_dock$EXPOSE(port)
   }
+  if (!is.null(user)) {
+    base_dock$USER(user)
+  }
   if (is.null(dockerfile_cmd)) {
     dockerfile_cmd <- sprintf(
       "R -e \"options('shiny.port'=%s,shiny.host='%s');library(%3$s);%3$s::run_app()\"",
@@ -315,6 +320,7 @@ add_dockerfile_with_renv_shinyproxy <- function(
   open = TRUE,
   document = TRUE,
   update_tar_gz = TRUE,
+  user = "rstudio",
   ...
 ) {
   add_dockerfile_with_renv(
@@ -333,6 +339,7 @@ add_dockerfile_with_renv_shinyproxy <- function(
     update_tar_gz = update_tar_gz,
     open = open,
     document = document,
+    user = user,
     dockerfile_cmd = sprintf(
       "R -e \"options('shiny.port'=3838,shiny.host='0.0.0.0');library(%1$s);%1$s::run_app()\"",
       get_golem_name(
@@ -360,6 +367,7 @@ add_dockerfile_with_renv_heroku <- function(
   extra_sysreqs = NULL,
   open = TRUE,
   document = TRUE,
+  user = "rstudio",
   update_tar_gz = TRUE,
   ...
 ) {
@@ -379,6 +387,7 @@ add_dockerfile_with_renv_heroku <- function(
     update_tar_gz = update_tar_gz,
     open = FALSE,
     document = document,
+    user = user,
     dockerfile_cmd = sprintf(
       "R -e \"options('shiny.port'=$PORT,shiny.host='0.0.0.0');library(%1$s);%1$s::run_app()\"",
       get_golem_name(
diff --git a/man/dockerfiles.Rd b/man/dockerfiles.Rd
index 6f9b0af7..1fd28d5e 100644
--- a/man/dockerfiles.Rd
+++ b/man/dockerfiles.Rd
@@ -73,6 +73,7 @@ add_dockerfile_with_renv(
   extra_sysreqs = NULL,
   update_tar_gz = TRUE,
   dockerfile_cmd = NULL,
+  user = "rstudio",
   ...
 )
 
@@ -90,6 +91,7 @@ add_dockerfile_with_renv_shinyproxy(
   open = TRUE,
   document = TRUE,
   update_tar_gz = TRUE,
+  user = "rstudio",
   ...
 )
 
@@ -106,6 +108,7 @@ add_dockerfile_with_renv_heroku(
   extra_sysreqs = NULL,
   open = TRUE,
   document = TRUE,
+  user = "rstudio",
   update_tar_gz = TRUE,
   ...
 )
@@ -165,6 +168,8 @@ See available distributions at https://hub.docker.com/r/rstudio/r-base/.}
 \item{dockerfile_cmd}{What is the CMD to add to the Dockerfile. If NULL, the default,
 the CMD will be \verb{R -e "options('shiny.port'=\{port\},shiny.host='\{host\}');library(\{appname\});\{appname\}::run_app()\\}.}
 
+\item{user}{Name of the user to specify in the Dockerfile with the USER instruction. Default is \code{rstudio}, if set to \code{NULL} no the user from the FROM image is used.}
+
 \item{...}{Other arguments to pass to \code{\link[renv:snapshot]{renv::snapshot()}}.}
 }
 \value{
diff --git a/man/rstudio_deploy.Rd b/man/rstudio_deploy.Rd
index 340238bd..4be92a71 100644
--- a/man/rstudio_deploy.Rd
+++ b/man/rstudio_deploy.Rd
@@ -33,7 +33,7 @@ Additionally, adds a \code{.rscignore} at the root of the \code{{golem}} project
 \code{rsconnect} package version is \verb{>= 0.8.25}.
 }
 \note{
-In previous versions, this function was called add_rconnect_file and add_rstudioconnect_file.
+In previous versions, this function was called add_rconnect_file.
 
 \code{add_rstudioconnect_file} is now deprecated; replace by \code{\link[=add_positconnect_file]{add_positconnect_file()}}.
 }