diff --git a/SECURITY.md b/SECURITY.md
index b06db4d..63acd1b 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -19,7 +19,7 @@ reporting feature:
 2. Click "New draft security advisory"
 3. Fill in the details
 
-Or email the maintainers directly (add contact email when established).
+If private advisory reporting is unavailable, open an issue tagged `security`.
 
 ## What to Include
 
diff --git a/src/uu/passwd/Cargo.toml b/src/uu/passwd/Cargo.toml
index b60d051..070afe1 100644
--- a/src/uu/passwd/Cargo.toml
+++ b/src/uu/passwd/Cargo.toml
@@ -19,7 +19,6 @@ clap = { workspace = true }
 libc = { workspace = true }
 nix = { workspace = true }
 shadow-core = { workspace = true, features = ["shadow", "login-defs"] }
-thiserror = { workspace = true }
 uucore = { workspace = true }
 
 [features]
diff --git a/src/uu/passwd/src/passwd.rs b/src/uu/passwd/src/passwd.rs
index eda324f..4b13f67 100644
--- a/src/uu/passwd/src/passwd.rs
+++ b/src/uu/passwd/src/passwd.rs
@@ -500,14 +500,18 @@ fn resolve_target_user(matches: &clap::ArgMatches) -> Result<String, PasswdError
     }
 }
 
-/// Check if the effective user is root.
+/// Check if the *real* user (caller) is root.
+///
+/// Uses `getuid()` (real UID), NOT `geteuid()` (effective UID).
+/// When passwd is installed setuid-root, euid is always 0 for all callers.
+/// The real UID tells us if the caller is actually root or a regular user.
 fn is_root() -> bool {
-    nix::unistd::geteuid().is_root()
+    nix::unistd::getuid().is_root()
 }
 
-/// Return the current user's username (from euid).
+/// Return the current user's username (from real UID).
 fn get_current_username() -> Result<String, PasswdError> {
-    let uid = nix::unistd::geteuid();
+    let uid = nix::unistd::getuid();
     match nix::unistd::User::from_uid(uid) {
         Ok(Some(user)) => Ok(user.name),
         Ok(None) => Err(PasswdError::UnexpectedFailure(format!(