diff --git a/tools/aconfig/aflags/src/main.rs b/tools/aconfig/aflags/src/main.rs
index 05c15bb..810f2e3 100644
--- a/tools/aconfig/aflags/src/main.rs
+++ b/tools/aconfig/aflags/src/main.rs
@@ -233,8 +233,6 @@
 }
 
 fn set_flag(qualified_name: &str, value: &str) -> Result<()> {
-    ensure!(nix::unistd::Uid::current().is_root(), "must be root to mutate flags");
-
     let flags_binding = DeviceConfigSource::list_flags()?;
     let flag = flags_binding.iter().find(|f| f.qualified_name() == qualified_name).ok_or(
         anyhow!("no aconfig flag '{qualified_name}'. Does the flag have an .aconfig definition?"),
@@ -282,7 +280,9 @@
     Ok(result)
 }
 
-fn main() {
+fn main() -> Result<()> {
+    ensure!(nix::unistd::Uid::current().is_root(), "must be root");
+
     let cli = Cli::parse();
     let output = match cli.command {
         Command::List { use_new_storage: true, container } => {
@@ -299,6 +299,8 @@
         Ok(None) => (),
         Err(message) => println!("Error: {message}"),
     }
+
+    Ok(())
 }
 
 #[cfg(test)]