diff --git a/src/bwrap.cpp b/src/bwrap.cpp
index f9eeffb..56861f5 100644
--- a/src/bwrap.cpp
+++ b/src/bwrap.cpp
@@ -113,13 +113,29 @@ std::optional<pid_t> find_fuse_overlayfs_pid(const std::string& merged_path) {
 
 std::vector<std::string> detect_bwrap_unshare_args() {
     std::vector<std::string> args;
+
+    bool user_ns_supported = kernel_supports_namespace(CLONE_NEWUSER);
+    spdlog::debug("namespace user: {}", user_ns_supported ? "supported" : "not supported");
+    if (user_ns_supported) {
+        args.push_back("--unshare-user");
+    }
+
     for (const auto& probe : kNamespaceProbes) {
-        bool supported = kernel_supports_namespace(probe.clone_flag);
+        if (probe.clone_flag == CLONE_NEWUSER) {
+            continue;
+        }
+        // As a regular (non-root) user, most namespace types can only be unshared
+        // together with a fresh user namespace (which supplies the capabilities
+        // needed), not in isolation -- so combine them here whenever the user
+        // namespace probe above succeeded.
+        int flags = probe.clone_flag | (user_ns_supported ? CLONE_NEWUSER : 0);
+        bool supported = kernel_supports_namespace(flags);
         spdlog::debug("namespace {}: {}", probe.name, supported ? "supported" : "not supported");
         if (supported) {
             args.push_back(probe.bwrap_arg);
         }
     }
+
     return args;
 }