diff --git a/profiles/base/accounts/group/policy-readers b/profiles/base/accounts/group/policy-readers
index 41f2e86..0e76e2a 100644
--- a/profiles/base/accounts/group/policy-readers
+++ b/profiles/base/accounts/group/policy-readers
@@ -1,4 +1,4 @@
 # Members have read access to the device policy in /var/lib/whitelist.
 group:policy-readers
 gid:303
-users:authpolicyd,chronos,u2f,shill
+users:attestation,authpolicyd,chronos,u2f,shill