diff --git a/.cci.jenkinsfile b/.cci.jenkinsfile
index 70a3b17ea..f774d7777 100644
--- a/.cci.jenkinsfile
+++ b/.cci.jenkinsfile
@@ -19,18 +19,31 @@ cosaPod(buildroot: true, runAsUser: 0) {
     // Make sure cosa is using the binary we just built.
     shwrap("rsync -rlv install/usr/ /usr/")
 
-    cosaBuild(skipKola: true, overlays: ["install"])
+    // XXX: temporarily build FCOS manually until virtiofs can work with uid 0
+    // https://gitlab.com/virtio-fs/virtiofsd/-/merge_requests/197
+    //cosaBuild(skipKola: true, overlays: ["install"])
+    shwrap("""
+        if [ "\$(id -u)" = 0 ]; then
+            exec runuser -u builder -- bash "\$0" "\$@"
+        fi
+        mkdir -p /srv/coreos && cd /srv/coreos
+        cosa init https://github.com/coreos/fedora-coreos-config
+        rsync -av ${env.WORKSPACE}/install/ /srv/coreos/overrides/rootfs
+        cosa fetch --strict
+        cosa build --strict --force
+    """)
+
     // Skipping kdump.crash due to CI failure in coreos-installer repo
     // https://github.com/coreos/fedora-coreos-tracker/issues/1075
     kola(extraArgs: "--denylist-test ext.config.kdump.crash")
 
     stage("Build metal+live") {
-        shwrap("cd /srv/coreos && cosa buildextend-metal")
-        shwrap("cd /srv/coreos && cosa buildextend-metal4k")
-        shwrap("cd /srv/coreos && cosa buildextend-live --fast")
+        shwrap("cd /srv/coreos && runuser -u builder -- cosa buildextend-metal")
+        shwrap("cd /srv/coreos && runuser -u builder -- cosa buildextend-metal4k")
+        shwrap("cd /srv/coreos && runuser -u builder -- cosa buildextend-live --fast")
         // Test metal with an uncompressed image and metal4k with a
         // compressed one
-        shwrap("cd /srv/coreos && cosa compress --fast --artifact=metal4k")
+        shwrap("cd /srv/coreos && runuser -u builder -- cosa compress --fast --artifact=metal4k")
     }
     stage("Test ISO") {
         // No need to run the iso-live-login/iso-as-disk scenarios
diff --git a/Cargo.lock b/Cargo.lock
index f3c810e11..7b327bd82 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -844,15 +844,6 @@ version = "2.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f232d6ef707e1956a43342693d2a31e72989554d58299d7a88738cc95b0d35c"
 
-[[package]]
-name = "memoffset"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5de893c32cde5f383baa4c04c5d6dbdd735cfd4a794b0debdb2bb1b421da5ff4"
-dependencies = [
- "autocfg",
-]
-
 [[package]]
 name = "mime"
 version = "0.3.17"
@@ -899,15 +890,13 @@ dependencies = [
 
 [[package]]
 name = "nix"
-version = "0.26.4"
+version = "0.27.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "598beaf3cc6fdd9a5dfb1630c2800c7acd31df7aaf0f565796fba2b53ca1af1b"
+checksum = "2eb04e9c688eff1c89d72b407f168cf79bb9e867a9d3323ed6c01519eb9cc053"
 dependencies = [
- "bitflags 1.3.2",
+ "bitflags 2.4.0",
  "cfg-if",
  "libc",
- "memoffset",
- "pin-utils",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 3eb81f756..6a8cc0fd8 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -63,7 +63,7 @@ hex = "^0.4"
 ignition-config = ">= 0.3, < 0.4"
 lazy_static = "^1.4"
 libc = "^0.2"
-nix = ">= 0.24, < 0.27"
+nix = { version = ">= 0.24, < 0.28", "default_features" = false, "features" = [ "dir", "ioctl", "mount", "process", "sched", "signal", "user"] }
 nmstate = { version = ">= 2.2.3, < 3", default-features = false, features = ["gen_conf"] }
 openssl = "^0.10"
 pipe = ">= 0.3, < 0.5"