diff --git a/operators/pkg/forge/cloudinit-startup.sh b/operators/pkg/forge/cloudinit-startup.sh
new file mode 100644
index 000000000..22bac3908
--- /dev/null
+++ b/operators/pkg/forge/cloudinit-startup.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+mkdir -p "$NFSPATH"
+chown 1000:1000 "$NFSPATH"
diff --git a/operators/pkg/forge/cloudinit.go b/operators/pkg/forge/cloudinit.go
index 08d620285..2b4cdb49b 100644
--- a/operators/pkg/forge/cloudinit.go
+++ b/operators/pkg/forge/cloudinit.go
@@ -15,6 +15,8 @@
 package forge
 
 import (
+	"bytes"
+	_ "embed"
 	"fmt"
 
 	"gopkg.in/yaml.v3"
@@ -49,6 +51,15 @@ type interf struct {
 	DHCP4 bool `yaml:"dhcp4"`
 }
 
+//go:embed cloudinit-startup.sh
+var scriptdata []byte
+
+// CloudInitUserScriptData configures and forges the cloud-init startup script.
+func CloudInitUserScriptData() ([]byte, error) {
+	userScriptData := bytes.ReplaceAll(scriptdata, []byte("$NFSPATH"), []byte(MyDriveVolumeMountPath))
+	return userScriptData, nil
+}
+
 // CloudInitUserData forges the yaml manifest representing the cloud-init userdata configuration.
 func CloudInitUserData(nfsServerName, nfsPath string, publicKeys []string) ([]byte, error) {
 	config := userdata{
@@ -73,7 +84,7 @@ func CloudInitUserData(nfsServerName, nfsPath string, publicKeys []string) ([]by
 			fmt.Sprintf("%s:%s", nfsServerName, nfsPath),
 			MyDriveVolumeMountPath,
 			"nfs",
-			"rw,tcp,hard,intr,rsize=8192,wsize=8192,timeo=14",
+			"rw,tcp,hard,intr,rsize=8192,wsize=8192,timeo=14,_netdev,user",
 			"0",
 			"0",
 		}}
diff --git a/operators/pkg/forge/cloudinit_test.go b/operators/pkg/forge/cloudinit_test.go
index dfa03dea4..67e941668 100644
--- a/operators/pkg/forge/cloudinit_test.go
+++ b/operators/pkg/forge/cloudinit_test.go
@@ -23,7 +23,7 @@ import (
 	"github.com/netgroup-polito/CrownLabs/operators/pkg/forge"
 )
 
-var _ = Describe("CloudInit userdata generation", func() {
+var _ = Describe("CloudInit files generation", func() {
 	Context("The CloudInitUserData function", func() {
 		const (
 			serviceName = "rook-ceph-nfs-my-nfs-a.rook-ceph.svc.cluster.local"
@@ -48,7 +48,7 @@ mounts:
     - - rook-ceph-nfs-my-nfs-a.rook-ceph.svc.cluster.local:/path
       - /media/mydrive
       - nfs
-      - rw,tcp,hard,intr,rsize=8192,wsize=8192,timeo=14
+      - rw,tcp,hard,intr,rsize=8192,wsize=8192,timeo=14,_netdev,user
       - "0"
       - "0"
 ssh_authorized_keys:
@@ -74,4 +74,20 @@ ssh_authorized_keys:
 		It("Should succeed", func() { Expect(err).ToNot(HaveOccurred()) })
 		It("Should match the expected output", func() { Expect(output).To(WithTransform(Transformer, Equal(Transformer([]byte(expected))))) })
 	})
+
+	Context("The CloudInitUserScriptData function", func() {
+		const expected = `#!/bin/bash
+mkdir -p "/media/mydrive"
+chown 1000:1000 "/media/mydrive"
+`
+
+		var (
+			scriptdata []byte
+			err        error
+		)
+		JustBeforeEach(func() { scriptdata, err = forge.CloudInitUserScriptData() })
+
+		It("Should succeed", func() { Expect(err).ToNot(HaveOccurred()) })
+		It("Should match the expected output", func() { Expect(scriptdata).To(Equal([]byte(expected))) })
+	})
 })
diff --git a/operators/pkg/instctrl/cloudinit.go b/operators/pkg/instctrl/cloudinit.go
index e5786c231..ccc592d77 100644
--- a/operators/pkg/instctrl/cloudinit.go
+++ b/operators/pkg/instctrl/cloudinit.go
@@ -71,12 +71,19 @@ func (r *InstanceReconciler) EnforceCloudInitSecret(ctx context.Context) error {
 		log.Error(err, "unable to marshal secret content")
 		return err
 	}
+
+	userScriptData, err := forge.CloudInitUserScriptData()
+	if err != nil {
+		log.Error(err, "unable to marshal secret content")
+		return err
+	}
+
 	// Enforce the cloud-init secret presence.
 	instance := clctx.InstanceFrom(ctx)
 	secret := corev1.Secret{ObjectMeta: forge.ObjectMeta(instance)}
 	res, err := ctrl.CreateOrUpdate(ctx, r.Client, &secret, func() error {
 		secret.SetLabels(forge.InstanceObjectLabels(secret.GetLabels(), instance))
-		secret.Data = map[string][]byte{UserDataKey: userdata}
+		secret.Data = map[string][]byte{UserDataKey: userdata, "x-shellscript": userScriptData}
 		secret.Type = corev1.SecretTypeOpaque
 		return ctrl.SetControllerReference(instance, &secret, r.Scheme)
 	})