diff --git a/Earthfile b/Earthfile
index 64b0b9a..8232e6e 100644
--- a/Earthfile
+++ b/Earthfile
@@ -271,6 +271,7 @@ uki-provider-image:
     RUN apt-get update && apt-get install -y rsync
 
     WORKDIR /
+    COPY overlay/files/etc/ /etc/
     COPY +luet/luet /usr/bin/luet
     COPY +kairos-agent/kairos-agent /usr/bin/kairos-agent
     COPY --platform=linux/${ARCH} +trust-boot-unpack/ /trusted-boot
@@ -557,6 +558,7 @@ provider-image:
         ARG BASE_K8S_VERSION=$K8S_VERSION-$K8S_DISTRIBUTION_TAG
     END
 
+    COPY overlay/files/etc/ /etc/
     COPY  --platform=linux/${ARCH} +kairos-provider-image/ /
     COPY +stylus-image/etc/kairos/branding /etc/kairos/branding
     COPY +stylus-image/oem/stylus_config.yaml /etc/kairos/branding/stylus_config.yaml
diff --git a/overlay/files/etc/rsyslog.d/49-stylus.conf b/overlay/files/etc/rsyslog.d/49-stylus.conf
index 4046b2d..a540b6b 100644
--- a/overlay/files/etc/rsyslog.d/49-stylus.conf
+++ b/overlay/files/etc/rsyslog.d/49-stylus.conf
@@ -1,7 +1,6 @@
 # Running rsyslog as root. 
 # TODO: should this be done or change acceptance criteria to about audit log file permissions accordingly 
 $PrivDropToUser root
-$PrivDropToGroup adm
 # default config has $Umask 0022 set. That breaks any config related to masks and modes.
 $Umask 0000
 
@@ -15,7 +14,6 @@ if ($syslogfacility-text == 'local7' and $syslogseverity-text == 'notice') then{
         file="/var/log/stylus-audit.log" 
 		FileCreateMode="0600"
 		fileowner="root"
-		fileGroup="adm"
         template="ForwardFormat"
 	) & stop
 }