diff --git a/manifests/plugin.pp b/manifests/plugin.pp
index 3232f4fc6..c33821892 100644
--- a/manifests/plugin.pp
+++ b/manifests/plugin.pp
@@ -139,6 +139,7 @@
       path    => ['/usr/bin', '/usr/sbin', '/bin'],
       onlyif  => "test -f ${plugin_dir}/${name}.jpi -a ! -f ${plugin_dir}/${name}.jpi.pinned",
       before  => Exec["download-${name}"],
+      user    => $username,
     }
 
     # if $source is specified, it overrides any other URL construction
@@ -152,6 +153,7 @@
       cwd     => $plugin_dir,
       require => [File[$plugin_dir], Package['wget']],
       path    => ['/usr/bin', '/usr/sbin', '/bin'],
+      user    => $username,
     }
 
     file { "${plugin_dir}/${plugin}" :
diff --git a/spec/defines/jenkins_plugin_spec.rb b/spec/defines/jenkins_plugin_spec.rb
index c8d083dcd..22369efb9 100644
--- a/spec/defines/jenkins_plugin_spec.rb
+++ b/spec/defines/jenkins_plugin_spec.rb
@@ -24,20 +24,26 @@
 
 
   describe 'without version' do
-    it { should contain_exec('download-myplug').with(
-      :command      => 'rm -rf myplug myplug.hpi myplug.jpi && wget --no-check-certificate http://updates.jenkins-ci.org/latest/myplug.hpi',
-      :environment  => nil
-    )}
+    it do
+      should contain_exec('download-myplug').with(
+        :command     => 'rm -rf myplug myplug.hpi myplug.jpi && wget --no-check-certificate http://updates.jenkins-ci.org/latest/myplug.hpi',
+        :user        => 'jenkins',
+        :environment => nil
+      )
+    end
     it { should contain_file('/var/lib/jenkins/plugins/myplug.hpi')}
   end
 
   describe 'with version' do
     let(:params) { { :version => '1.2.3' } }
 
-    it { should contain_exec('download-myplug').with(
-      :command      => 'rm -rf myplug myplug.hpi myplug.jpi && wget --no-check-certificate http://updates.jenkins-ci.org/download/plugins/myplug/1.2.3/myplug.hpi',
-      :environment  => nil
-    ) }
+    it do
+      should contain_exec('download-myplug').with(
+        :command     => 'rm -rf myplug myplug.hpi myplug.jpi && wget --no-check-certificate http://updates.jenkins-ci.org/download/plugins/myplug/1.2.3/myplug.hpi',
+        :user        => 'jenkins',
+        :environment => nil
+      )
+    end
     it { should contain_file('/var/lib/jenkins/plugins/myplug.hpi')}
   end
 
@@ -96,7 +102,14 @@
       'include jenkins'
     ]}
 
-    it { should contain_exec('download-myplug').with(:environment => ["http_proxy=proxy.company.com:8080", "https_proxy=proxy.company.com:8080"]) }
+    it do
+      should contain_exec('download-myplug').with(
+        :environment => [
+          "http_proxy=proxy.company.com:8080",
+          "https_proxy=proxy.company.com:8080",
+        ]
+      )
+    end
   end
 
   describe 'with a custom update center' do
@@ -168,6 +181,7 @@
       it 'should download from $source url' do
          should contain_exec('download-myplug').with(
           :command     => 'rm -rf myplug myplug.hpi myplug.jpi && wget --no-check-certificate http://e.org/myplug.hpi',
+          :user        => 'jenkins',
           :cwd         => '/var/lib/jenkins/plugins',
           :environment => nil,
           :path        => ['/usr/bin', '/usr/sbin', '/bin'],