diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 17ed45e..511d602 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -29,6 +29,7 @@ jobs:
               install -d -m 700 /etc/NetworkManager/system-connections
               install -m 600 /src/files/dpea-eth0.nmconnection \
                 /etc/NetworkManager/system-connections/dpea-eth0.nmconnection
+              install -D -m 644 /src/files/91-odrive.rules /etc/udev/rules.d/91-odrive.rules
               # Reproduce replacement conflicts with the stock avahi package.
               apt-get install -y avahi-daemon libnss-mdns
               # Reproduce the conffile prompt caused by Raspberry Pi OS's modified config.
@@ -48,6 +49,8 @@ jobs:
               test -L /etc/systemd/system/serial-getty@ttyAMA0.service && echo "OK   serial getty masked" || { echo "FAIL serial getty not masked"; fail=1; }
               test -f /etc/NetworkManager/system-connections/dpea-eth0.nmconnection \
                 && echo "OK   eth0 profile present" || { echo "FAIL eth0 profile"; fail=1; }
+              test -f /etc/udev/rules.d/91-odrive.rules \
+                && echo "OK   odrive udev rule present" || { echo "FAIL odrive udev rule"; fail=1; }
               (service dbus start >/dev/null 2>&1 || true; avahi-daemon -D >/dev/null 2>&1 || true; sleep 2)
               if ss -lun 2>/dev/null | grep -q ":5358"; then echo "OK   avahi listening on 5358"
               else echo "WARN could not confirm 5358 in container (verify on hardware)"; fi
diff --git a/README.md b/README.md
index f362457..ddbb286 100644
--- a/README.md
+++ b/README.md
@@ -17,6 +17,8 @@ dependencies and installs them with `uv`.
   `172.17.21.2/22` for a direct laptop-to-Pi cable.
 - **mDNS**: the patched avahi that serves mDNS on port **5358**.
 - **Tooling**: `uv`, system-wide.
+- **ODrive USB**: a udev rule (`91-odrive.rules`) makes ODrive devices accessible
+  to non-root users, since `uv` cannot install udev rules.
 
 ### Shared apt packages (`packages.txt`)
 
diff --git a/build-image.sh b/build-image.sh
index 80a0440..9d32e0f 100755
--- a/build-image.sh
+++ b/build-image.sh
@@ -41,6 +41,7 @@ install -m 644 "$HERE/packages.txt" "$MNT/tmp/packages.txt"
 install -d -m 700 "$MNT/etc/NetworkManager/system-connections"
 install -m 600 "$HERE/files/dpea-eth0.nmconnection" \
 	"$MNT/etc/NetworkManager/system-connections/dpea-eth0.nmconnection"
+install -m 644 "$HERE/files/91-odrive.rules" "$MNT/etc/udev/rules.d/91-odrive.rules"
 install -m 755 "$HERE/customize.sh" "$MNT/tmp/customize.sh"
 chroot "$MNT" /bin/bash /tmp/customize.sh
 rm -f "$MNT/tmp/customize.sh"
diff --git a/customize.sh b/customize.sh
index 852e5fe..a1f7057 100755
--- a/customize.sh
+++ b/customize.sh
@@ -45,6 +45,8 @@ curl -LsSf https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin s
 
 chown root:root /etc/NetworkManager/system-connections/dpea-eth0.nmconnection
 chmod 600      /etc/NetworkManager/system-connections/dpea-eth0.nmconnection
+chown root:root /etc/udev/rules.d/91-odrive.rules
+chmod 644      /etc/udev/rules.d/91-odrive.rules
 
 apt-get clean
 rm -f /tmp/packages.txt
diff --git a/files/91-odrive.rules b/files/91-odrive.rules
new file mode 100644
index 0000000..6bdd5f3
--- /dev/null
+++ b/files/91-odrive.rules
@@ -0,0 +1 @@
+SUBSYSTEM=="usb", ATTR{idVendor}=="1209", ATTR{idProduct}=="0d[0-9][0-9]", MODE="0666"