diff --git a/src/node_credentials.cc b/src/node_credentials.cc
index c0abb4f65b6179..7a4bf35439736b 100644
--- a/src/node_credentials.cc
+++ b/src/node_credentials.cc
@@ -40,8 +40,8 @@ namespace credentials {
 // same).
 bool SafeCapGetenv(const char* key, std::string* text) {
 #if !defined(__CloudABI__) && !defined(_WIN32)
-  if (per_process::linux_at_secure && (getuid() != geteuid() ||
-      getgid() != getegid()) || getuid() == 0) {
+  if (per_process::linux_at_secure && ((getuid() != geteuid() ||
+      getgid() != getegid()) || getuid() == 0)) {
     goto fail;
   }
 #endif