diff --git a/metropolis/node/BUILD.bazel b/metropolis/node/BUILD.bazel
index 6ae234a..c09ca2d 100644
--- a/metropolis/node/BUILD.bazel
+++ b/metropolis/node/BUILD.bazel
@@ -33,6 +33,10 @@
     },
 )
 
+exports_files([
+    "passwd",
+])
+
 erofs_image(
     name = "rootfs",
     files = {
@@ -42,6 +46,7 @@
         # These should not be explicitly used by Metropolis code and are only here for compatibility with
         # paths hardcoded by standard libraries (like Go's).
         "@cacerts//file": "/etc/ssl/cert.pem",
+        "//metropolis/node:passwd": "/etc/passwd",
         "//osbase/net/dns:resolv.conf": "/etc/resolv.conf",
         "//osbase/net/dns:hosts": "/etc/hosts",
         ":os-release-info": "/etc/os-release",
diff --git a/metropolis/node/kubernetes/BUILD.bazel b/metropolis/node/kubernetes/BUILD.bazel
index 9f51ba0..15eec36 100644
--- a/metropolis/node/kubernetes/BUILD.bazel
+++ b/metropolis/node/kubernetes/BUILD.bazel
@@ -66,6 +66,7 @@
         "@io_k8s_component_base//featuregate",
         "@io_k8s_kubelet//config/v1beta1",
         "@io_k8s_kubelet//pkg/apis/pluginregistration/v1:pluginregistration",
+        "@io_k8s_kubernetes//pkg/features",
         "@io_k8s_kubernetes//plugin/pkg/admission/security/podsecurity",
         "@io_k8s_pod_security_admission//admission/api/v1:api",
         "@org_golang_google_grpc//:grpc",
diff --git a/metropolis/node/kubernetes/feature_gates.go b/metropolis/node/kubernetes/feature_gates.go
index 06d970f..9be3b35 100644
--- a/metropolis/node/kubernetes/feature_gates.go
+++ b/metropolis/node/kubernetes/feature_gates.go
@@ -5,6 +5,7 @@
 	"strings"
 
 	"k8s.io/component-base/featuregate"
+	"k8s.io/kubernetes/pkg/features"
 )
 
 type featureGates map[featuregate.Feature]bool
@@ -32,4 +33,7 @@
 	return out
 }
 
-var extraFeatureGates = featureGates{}
+var extraFeatureGates = featureGates{
+	features.UserNamespacesSupport:              true,
+	features.UserNamespacesPodSecurityStandards: true,
+}
diff --git a/metropolis/node/passwd b/metropolis/node/passwd
new file mode 100644
index 0000000..e363ba6
--- /dev/null
+++ b/metropolis/node/passwd
@@ -0,0 +1 @@
+root:x:0:0:root:/nonexistent:/sbin/nologin