diff --git a/pipeline/frontend/yaml/compiler/convert.go b/pipeline/frontend/yaml/compiler/convert.go
index 37d899e01..144fd827e 100644
--- a/pipeline/frontend/yaml/compiler/convert.go
+++ b/pipeline/frontend/yaml/compiler/convert.go
@@ -84,7 +84,7 @@ func (c *Compiler) createProcess(name string, container *yaml.Container, section
 		}
 	}
 
-	if matchImage(container.Image, c.escalated...) {
+	if matchImage(container.Image, c.escalated...) && container.IsPlugin() {
 		privileged = true
 	}