diff --git a/PVE/API2/Qemu.pm b/PVE/API2/Qemu.pm
index 6f9781c3..abba38b6 100644
--- a/PVE/API2/Qemu.pm
+++ b/PVE/API2/Qemu.pm
@@ -819,7 +819,7 @@ my sub check_rng_perm {
 
     my $device = PVE::JSONSchema::parse_property_string('pve-qm-rng', $value);
     if ($device->{source} && $device->{source} eq '/dev/hwrng') {
-	die "only root can set '$opt' config for a non-mapped Hardware RNG device\n";
+	$rpcenv->check_full($authuser, "/mapping/hwrng", ['Mapping.Use']);
     }
 
     return 1;
diff --git a/PVE/QemuServer.pm b/PVE/QemuServer.pm
index ae3d88d2..fe060cc1 100644
--- a/PVE/QemuServer.pm
+++ b/PVE/QemuServer.pm
@@ -6461,7 +6461,7 @@ sub check_mapping_access {
 	    my $device = PVE::JSONSchema::parse_property_string('pve-qm-rng', $conf->{$opt});
 
 	    if ($device->{source} && $device->{source} eq '/dev/hwrng') {
-		die "only root can set '$opt' config for a non-mapped Hardware RNG device\n";
+		$rpcenv->check_full($user, "/mapping/hwrng", ['Mapping.Use']);
 	    }
 	}
     }