diff --git a/pkg/cli/agent/agent.go b/pkg/cli/agent/agent.go
index aeede9c91a..ecc010871f 100644
--- a/pkg/cli/agent/agent.go
+++ b/pkg/cli/agent/agent.go
@@ -33,8 +33,8 @@ func Run(ctx *cli.Context) error {
 		return err
 	}
 
-	if os.Getuid() != 0 && runtime.GOOS != "windows" {
-		return fmt.Errorf("agent must be ran as root")
+	if runtime.GOOS != "windows" && os.Getuid() != 0 && !cmds.AgentConfig.Rootless {
+		return fmt.Errorf("agent must be run as root, or with --rootless")
 	}
 
 	if cmds.AgentConfig.TokenFile != "" {
diff --git a/pkg/cli/server/server.go b/pkg/cli/server/server.go
index 0989519a0a..0076d97dc3 100644
--- a/pkg/cli/server/server.go
+++ b/pkg/cli/server/server.go
@@ -71,7 +71,7 @@ func run(app *cli.Context, cfg *cmds.Server, leaderControllers server.CustomCont
 	}
 
 	if !cfg.DisableAgent && os.Getuid() != 0 && !cfg.Rootless {
-		return fmt.Errorf("must run as root unless --disable-agent is specified")
+		return fmt.Errorf("server must run as root, or with --rootless and/or --disable-agent")
 	}
 
 	if cfg.Rootless {