diff --git a/setup.sh b/setup.sh
index b9f2853e1e..1b473a1188 100755
--- a/setup.sh
+++ b/setup.sh
@@ -5,16 +5,20 @@ set -euo pipefail
 # allow this script to be invoked from any folder
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
-if [[ "$OSTYPE" == "darwin"* ]] && [[ $EUID -eq 0 ]]; then
-  echo "Do NOT run this script with sudo on macOS"
+if [ $EUID -ne 0 ]; then
+  echo "This script must be run with sudo"
   exit 1
 fi
 
-if [[ "$OSTYPE" != "darwin"* ]] && [[ $EUID -ne 0 ]]; then
-  echo "This script must be run with sudo on Linux"
-  exit 1
-fi
 
+# Run a command as the original user if invoked via sudo, otherwise run directly
+run_as_user() {
+  if [[ -n "${SUDO_USER:-}" ]]; then
+    sudo -u "$SUDO_USER" "$@"
+  else
+    "$@"
+  fi
+}
 tmpfile=$(mktemp)
 # any error messages from this command will stand out
 # more clearly when run as a separate command rather than
@@ -25,7 +29,7 @@ if grep -q "^-" "$tmpfile"; then
   if [[ "$OSTYPE" == "darwin"* ]]; then
     git submodule update --init --recursive
   else
-    sudo -u $SUDO_USER git submodule update --init --recursive
+    run_as_user git submodule update --init --recursive
   fi
 elif grep -q "^+" "$tmpfile"; then
   # Make it easy for users who are not hacking ORFS to do the right thing,
@@ -39,5 +43,5 @@ fi
 if [[ "$OSTYPE" == "darwin"* ]]; then
   "$DIR/etc/DependencyInstaller.sh" -common -prefix="$DIR/dependencies"
 else
-  sudo -u $SUDO_USER "$DIR/etc/DependencyInstaller.sh" -common -prefix="$DIR/dependencies"
+  run_as_user "$DIR/etc/DependencyInstaller.sh" -common -prefix="$DIR/dependencies"
 fi