diff --git a/bin/bfaupdate.sh b/bin/bfaupdate.sh
index 2e97564af695cfb90d16bab5f99a02d9d76750b2..25c3f4d49f826f819e7b4d1885d1f53ed2a85da3 100755
--- a/bin/bfaupdate.sh
+++ b/bin/bfaupdate.sh
@@ -16,13 +16,29 @@ function runasownerof
     path=$1
     precmd=
     shift 1
+    pushd $path > /dev/null
     if [ $( stat --format=%u $path ) -ne $UID ]
     then
         precmd="sudo -u $( stat --format=%U $path )"
     fi
     unset path
     ${precmd} "$@"
+    rv=$?
+    popd > /dev/null
     unset precmd
+    return $rv
+}
+
+function aptinstall
+{
+    for pkg in $*
+    do
+        dpkg --verify $pkg 2>/dev/null ||
+        (
+            info "Installing $pkg"
+            runasownerof / apt -y install $pkg
+        )
+    done
 }
 
 set -x
@@ -39,6 +55,8 @@ then
     runasownerof ${BFAHOME} git pull
     exec $0 wealreadypulled
 else
-    runasownerof / apt -y install libclass-accessor-perl
+    aptinstall libclass-accessor-perl
+    # make sure bfa is in group sudo
+    id bfa | grep -q sudo || runasownerof / adduser bfa sudo
     runasownerof ${BFAHOME} npm rebuild
 fi