diff --git a/package/strongswan/Config.in b/package/strongswan/Config.in
index feaf714213..047b460be8 100644
--- a/package/strongswan/Config.in
+++ b/package/strongswan/Config.in
@@ -204,6 +204,11 @@ config BR2_PACKAGE_STRONGSWAN_SQL
 config BR2_PACKAGE_STRONGSWAN_BYPASS_LAN
 	bool "Enable BYPASS-LAN plugin"
 
+config BR2_PACKAGE_STRONGSWAN_NONROOT
+	bool "Run as non-root"
+	help
+	  This allows running the IKE charon daemon as the non-root
+	  user/group charon/charon.
 endif
 
 config BR2_PACKAGE_STRONGSWAN_PKI
diff --git a/package/strongswan/strongswan.mk b/package/strongswan/strongswan.mk
index 072d8681d4..0ee26df43d 100644
--- a/package/strongswan/strongswan.mk
+++ b/package/strongswan/strongswan.mk
@@ -66,6 +66,16 @@ ifeq ($(BR2_PACKAGE_STRONGSWAN_DROP_CAPS),y)
 STRONGSWAN_CONF_OPTS += --with-capabilities=libcap
 endif
 
+ifeq ($(BR2_PACKAGE_STRONGSWAN_NONROOT),y)
+STRONGSWAN_CONF_OPTS += \
+	--with-user=charon \
+	--with-group=charon
+
+define STRONGSWAN_USERS
+	charon -1 charon -1 * - - -
+endef
+endif
+
 ifeq ($(BR2_TOOLCHAIN_HAS_LIBATOMIC),y)
 STRONGSWAN_CONF_ENV += LIBS='-latomic'
 endif