diff --git a/sbin/hastctl/hastctl.c b/sbin/hastctl/hastctl.c
index beb2fa13a648..b3cd10611e25 100644
--- a/sbin/hastctl/hastctl.c
+++ b/sbin/hastctl/hastctl.c
@@ -491,6 +491,11 @@ main(int argc, char *argv[])
 		pjdlog_exit(EX_OSERR, "Unable to connect to hastd via %s",
 		    cfg->hc_controladdr);
 	}
+
+	if (drop_privs() != 0)
+		exit(EX_CONFIG);
+	pjdlog_debug(1, "Privileges successfully dropped.");
+
 	/* Send the command to the server... */
 	if (hast_proto_send(NULL, controlconn, nv, NULL, 0) < 0) {
 		pjdlog_exit(EX_UNAVAILABLE,