diff --git a/operators/pkg/forge/cloudinit-startup.sh b/operators/pkg/forge/cloudinit-startup.sh
new file mode 100644
index 000000000..22bac3908
--- /dev/null
+++ b/operators/pkg/forge/cloudinit-startup.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+mkdir -p "$NFSPATH"
+chown 1000:1000 "$NFSPATH"
diff --git a/operators/pkg/forge/cloudinit.go b/operators/pkg/forge/cloudinit.go
index c77605bda..2b4cdb49b 100644
--- a/operators/pkg/forge/cloudinit.go
+++ b/operators/pkg/forge/cloudinit.go
@@ -15,6 +15,8 @@
 package forge
 
 import (
+	"bytes"
+	_ "embed"
 	"fmt"
 
 	"gopkg.in/yaml.v3"
@@ -49,6 +51,15 @@ type interf struct {
 	DHCP4 bool `yaml:"dhcp4"`
 }
 
+//go:embed cloudinit-startup.sh
+var scriptdata []byte
+
+// CloudInitUserScriptData configures and forges the cloud-init startup script.
+func CloudInitUserScriptData() ([]byte, error) {
+	userScriptData := bytes.ReplaceAll(scriptdata, []byte("$NFSPATH"), []byte(MyDriveVolumeMountPath))
+	return userScriptData, nil
+}
+
 // CloudInitUserData forges the yaml manifest representing the cloud-init userdata configuration.
 func CloudInitUserData(nfsServerName, nfsPath string, publicKeys []string) ([]byte, error) {
 	config := userdata{
diff --git a/operators/pkg/forge/cloudinit_test.go b/operators/pkg/forge/cloudinit_test.go
index 63f5c876b..67e941668 100644
--- a/operators/pkg/forge/cloudinit_test.go
+++ b/operators/pkg/forge/cloudinit_test.go
@@ -23,7 +23,7 @@ import (
 	"github.com/netgroup-polito/CrownLabs/operators/pkg/forge"
 )
 
-var _ = Describe("CloudInit userdata generation", func() {
+var _ = Describe("CloudInit files generation", func() {
 	Context("The CloudInitUserData function", func() {
 		const (
 			serviceName = "rook-ceph-nfs-my-nfs-a.rook-ceph.svc.cluster.local"
@@ -48,7 +48,7 @@ mounts:
     - - rook-ceph-nfs-my-nfs-a.rook-ceph.svc.cluster.local:/path
       - /media/mydrive
       - nfs
-      - rw,tcp,hard,intr,rsize=8192,wsize=8192,timeo=14,all_squash,anonuid=1000,anongid=1000
+      - rw,tcp,hard,intr,rsize=8192,wsize=8192,timeo=14,_netdev,user
       - "0"
       - "0"
 ssh_authorized_keys:
@@ -74,4 +74,20 @@ ssh_authorized_keys:
 		It("Should succeed", func() { Expect(err).ToNot(HaveOccurred()) })
 		It("Should match the expected output", func() { Expect(output).To(WithTransform(Transformer, Equal(Transformer([]byte(expected))))) })
 	})
+
+	Context("The CloudInitUserScriptData function", func() {
+		const expected = `#!/bin/bash
+mkdir -p "/media/mydrive"
+chown 1000:1000 "/media/mydrive"
+`
+
+		var (
+			scriptdata []byte
+			err        error
+		)
+		JustBeforeEach(func() { scriptdata, err = forge.CloudInitUserScriptData() })
+
+		It("Should succeed", func() { Expect(err).ToNot(HaveOccurred()) })
+		It("Should match the expected output", func() { Expect(scriptdata).To(Equal([]byte(expected))) })
+	})
 })
diff --git a/operators/pkg/instctrl/cloudinit-startup.sh b/operators/pkg/instctrl/cloudinit-startup.sh
deleted file mode 100644
index 364fbbf04..000000000
--- a/operators/pkg/instctrl/cloudinit-startup.sh
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/bin/bash
-mkdir -p $NFSPATH
-chown 1000:1000 $NFSPATH
diff --git a/operators/pkg/instctrl/cloudinit.go b/operators/pkg/instctrl/cloudinit.go
index e07cd1af2..ccc592d77 100644
--- a/operators/pkg/instctrl/cloudinit.go
+++ b/operators/pkg/instctrl/cloudinit.go
@@ -15,9 +15,7 @@
 package instctrl
 
 import (
-	"bytes"
 	"context"
-	_ "embed"
 	"fmt"
 
 	corev1 "k8s.io/api/core/v1"
@@ -43,9 +41,6 @@ const (
 	UserDataKey = "userdata"
 )
 
-//go:embed cloudinit-startup.sh
-var scriptdata []byte
-
 // EnforceCloudInitSecret enforces the creation/update of a secret containing the cloud-init configuration,
 // based on the information retrieved for the tenant object and its associated WebDav credentials.
 func (r *InstanceReconciler) EnforceCloudInitSecret(ctx context.Context) error {
@@ -77,7 +72,11 @@ func (r *InstanceReconciler) EnforceCloudInitSecret(ctx context.Context) error {
 		return err
 	}
 
-	userScriptData := bytes.ReplaceAll(scriptdata, []byte("$NFSPATH"), []byte(forge.MyDriveVolumeMountPath))
+	userScriptData, err := forge.CloudInitUserScriptData()
+	if err != nil {
+		log.Error(err, "unable to marshal secret content")
+		return err
+	}
 
 	// Enforce the cloud-init secret presence.
 	instance := clctx.InstanceFrom(ctx)