diff --git a/api/gen/proto/go/teleport/userprovisioning/v2/statichostuser.pb.go b/api/gen/proto/go/teleport/userprovisioning/v2/statichostuser.pb.go
index 36786986c953..b72bbb2125e1 100644
--- a/api/gen/proto/go/teleport/userprovisioning/v2/statichostuser.pb.go
+++ b/api/gen/proto/go/teleport/userprovisioning/v2/statichostuser.pb.go
@@ -145,6 +145,8 @@ type Matcher struct {
 	Gid int64 `protobuf:"varint,6,opt,name=gid,proto3" json:"gid,omitempty"`
 	// default_shell is the new user's default shell
 	DefaultShell string `protobuf:"bytes,7,opt,name=default_shell,json=defaultShell,proto3" json:"default_shell,omitempty"`
+	// take_ownership_if_user_exists will take ownership of existing, unmanaged users
+	TakeOwnershipIfUserExists bool `protobuf:"varint,8,opt,name=take_ownership_if_user_exists,json=takeOwnershipIfUserExists,proto3" json:"take_ownership_if_user_exists,omitempty"`
 }
 
 func (x *Matcher) Reset() {
@@ -228,6 +230,13 @@ func (x *Matcher) GetDefaultShell() string {
 	return ""
 }
 
+func (x *Matcher) GetTakeOwnershipIfUserExists() bool {
+	if x != nil {
+		return x.TakeOwnershipIfUserExists
+	}
+	return false
+}
+
 // StaticHostUserSpec is the static host user spec.
 type StaticHostUserSpec struct {
 	state         protoimpl.MessageState
@@ -302,7 +311,7 @@ var file_teleport_userprovisioning_v2_statichostuser_proto_rawDesc = []byte{
 	0x72, 0x74, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
 	0x69, 0x6e, 0x67, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63, 0x48, 0x6f, 0x73,
 	0x74, 0x55, 0x73, 0x65, 0x72, 0x53, 0x70, 0x65, 0x63, 0x52, 0x04, 0x73, 0x70, 0x65, 0x63, 0x22,
-	0xf5, 0x01, 0x0a, 0x07, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x72, 0x12, 0x39, 0x0a, 0x0b, 0x6e,
+	0xb7, 0x02, 0x0a, 0x07, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x72, 0x12, 0x39, 0x0a, 0x0b, 0x6e,
 	0x6f, 0x64, 0x65, 0x5f, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
 	0x32, 0x18, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x61, 0x62, 0x65,
 	0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x52, 0x0a, 0x6e, 0x6f, 0x64, 0x65,
@@ -317,19 +326,23 @@ var file_teleport_userprovisioning_v2_statichostuser_proto_rawDesc = []byte{
 	0x12, 0x10, 0x0a, 0x03, 0x67, 0x69, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x03, 0x52, 0x03, 0x67,
 	0x69, 0x64, 0x12, 0x23, 0x0a, 0x0d, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x73, 0x68,
 	0x65, 0x6c, 0x6c, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x64, 0x65, 0x66, 0x61, 0x75,
-	0x6c, 0x74, 0x53, 0x68, 0x65, 0x6c, 0x6c, 0x22, 0x57, 0x0a, 0x12, 0x53, 0x74, 0x61, 0x74, 0x69,
-	0x63, 0x48, 0x6f, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x53, 0x70, 0x65, 0x63, 0x12, 0x41, 0x0a,
-	0x08, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x25, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x70,
-	0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x69, 0x6e, 0x67, 0x2e, 0x76, 0x32, 0x2e, 0x4d,
-	0x61, 0x74, 0x63, 0x68, 0x65, 0x72, 0x52, 0x08, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x72, 0x73,
-	0x42, 0x64, 0x5a, 0x62, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67,
-	0x72, 0x61, 0x76, 0x69, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x65, 0x6c,
-	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f,
-	0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x69, 0x6e, 0x67,
-	0x2f, 0x76, 0x32, 0x3b, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f,
-	0x6e, 0x69, 0x6e, 0x67, 0x76, 0x32, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x6c, 0x74, 0x53, 0x68, 0x65, 0x6c, 0x6c, 0x12, 0x40, 0x0a, 0x1d, 0x74, 0x61, 0x6b, 0x65, 0x5f,
+	0x6f, 0x77, 0x6e, 0x65, 0x72, 0x73, 0x68, 0x69, 0x70, 0x5f, 0x69, 0x66, 0x5f, 0x75, 0x73, 0x65,
+	0x72, 0x5f, 0x65, 0x78, 0x69, 0x73, 0x74, 0x73, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x19,
+	0x74, 0x61, 0x6b, 0x65, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x73, 0x68, 0x69, 0x70, 0x49, 0x66, 0x55,
+	0x73, 0x65, 0x72, 0x45, 0x78, 0x69, 0x73, 0x74, 0x73, 0x22, 0x57, 0x0a, 0x12, 0x53, 0x74, 0x61,
+	0x74, 0x69, 0x63, 0x48, 0x6f, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x53, 0x70, 0x65, 0x63, 0x12,
+	0x41, 0x0a, 0x08, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x25, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75, 0x73, 0x65,
+	0x72, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x69, 0x6e, 0x67, 0x2e, 0x76, 0x32,
+	0x2e, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x72, 0x52, 0x08, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65,
+	0x72, 0x73, 0x42, 0x64, 0x5a, 0x62, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d,
+	0x2f, 0x67, 0x72, 0x61, 0x76, 0x69, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2f, 0x74,
+	0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x67, 0x65, 0x6e, 0x2f,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72,
+	0x74, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x69,
+	0x6e, 0x67, 0x2f, 0x76, 0x32, 0x3b, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73,
+	0x69, 0x6f, 0x6e, 0x69, 0x6e, 0x67, 0x76, 0x32, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/api/proto/teleport/userprovisioning/v2/statichostuser.proto b/api/proto/teleport/userprovisioning/v2/statichostuser.proto
index ef60d3eb7080..8c1757debc72 100644
--- a/api/proto/teleport/userprovisioning/v2/statichostuser.proto
+++ b/api/proto/teleport/userprovisioning/v2/statichostuser.proto
@@ -55,6 +55,8 @@ message Matcher {
   int64 gid = 6;
   // default_shell is the new user's default shell
   string default_shell = 7;
+  // take_ownership_if_user_exists will take ownership of existing, unmanaged users
+  bool take_ownership_if_user_exists = 8;
 }
 
 // StaticHostUserSpec is the static host user spec.
diff --git a/lib/auth/auth.go b/lib/auth/auth.go
index 8f79aaa9b668..fa5ad16098f5 100644
--- a/lib/auth/auth.go
+++ b/lib/auth/auth.go
@@ -5918,7 +5918,6 @@ func (a *Server) CleanupNotifications(ctx context.Context) {
 		// If this notification state is for a notification which doesn't exist in either the non-expired global notifications map or
 		// the non-expired user notifications map, then delete it.
 		if nonExpiredGlobalNotificationsByID[id] == nil && nonExpiredUserNotificationsByID[id] == nil {
-			fmt.Printf("\n\nTHIS IS RUN\n\n")
 			select {
 			case <-notificationsDeleteLimiter.C:
 			case <-ctx.Done():
diff --git a/lib/services/access_checker.go b/lib/services/access_checker.go
index 746f85b4ea64..0c8c9557d91a 100644
--- a/lib/services/access_checker.go
+++ b/lib/services/access_checker.go
@@ -1009,6 +1009,11 @@ type HostUsersInfo struct {
 	GID string
 	// Shell is the default login shell for a host user
 	Shell string
+	// TakeOwnership determines whether or not an existing user should be
+	// taken over by teleport. This currently only applies to 'static' mode
+	// users, 'keep' mode users still need to assign 'teleport-keep' in the
+	// Groups slice in order to take ownership.
+	TakeOwnership bool
 }
 
 // HostUsers returns host user information matching a server or nil if
diff --git a/lib/srv/statichostusers.go b/lib/srv/statichostusers.go
index 9dcbe0662772..ace0797f1498 100644
--- a/lib/srv/statichostusers.go
+++ b/lib/srv/statichostusers.go
@@ -245,9 +245,10 @@ func (s *StaticHostUserHandler) handleNewHostUser(ctx context.Context, hostUser
 
 	slog.DebugContext(ctx, "Attempt to update matched static host user.", "login", login)
 	ui := services.HostUsersInfo{
-		Groups: createUser.Groups,
-		Mode:   services.HostUserModeStatic,
-		Shell:  createUser.DefaultShell,
+		Groups:        createUser.Groups,
+		Mode:          services.HostUserModeStatic,
+		Shell:         createUser.DefaultShell,
+		TakeOwnership: createUser.TakeOwnershipIfUserExists,
 	}
 	if createUser.Uid != 0 {
 		ui.UID = strconv.Itoa(int(createUser.Uid))
diff --git a/lib/srv/usermgmt.go b/lib/srv/usermgmt.go
index 98eaccf28401..4b3324785013 100644
--- a/lib/srv/usermgmt.go
+++ b/lib/srv/usermgmt.go
@@ -254,18 +254,21 @@ func (u *HostUserManagement) updateUser(name string, ui services.HostUsersInfo)
 
 	// allow for explicit assignment of teleport-keep group in order to facilitate migrating KEEP users that existed before we added
 	// the teleport-keep group
-	migrateKeepUser := slices.Contains(ui.Groups, types.TeleportKeepGroup)
+	migrateKeepUser := slices.Contains(ui.Groups, types.TeleportKeepGroup) && ui.Mode == services.HostUserModeKeep
+	migrateStaticUser := ui.TakeOwnership && ui.Mode == services.HostUserModeStatic
 
 	_, hasDropGroup := currentGroups[types.TeleportDropGroup]
 	_, hasKeepGroup := currentGroups[types.TeleportKeepGroup]
 	_, hasStaticGroup := currentGroups[types.TeleportStaticGroup]
-	if !(hasDropGroup || hasKeepGroup || hasStaticGroup || migrateKeepUser) {
+	isManagedUser := hasDropGroup || hasKeepGroup || hasStaticGroup
+	if !(isManagedUser || migrateKeepUser || migrateStaticUser) {
 		return nil, trace.Errorf("%q %w", name, unmanagedUserErr)
 	}
 
 	// Do not convert/update groups from static to non-static user, and vice versa.
-	isStaticUser := ui.Mode == services.HostUserModeStatic
-	if hasStaticGroup != isStaticUser {
+	isStaticMode := ui.Mode == services.HostUserModeStatic
+	managedStaticConversion := isManagedUser && (hasStaticGroup != isStaticMode)
+	if managedStaticConversion {
 		slog.DebugContext(context.Background(),
 			"Aborting host user creation, can't convert between auto-provisioned and static host users.",
 			"login", name)
@@ -430,10 +433,10 @@ func (u *HostUserManagement) ensureGroupsExist(groups ...string) error {
 func (u *HostUserManagement) UpsertUser(name string, ui services.HostUsersInfo) (io.Closer, error) {
 	// allow for explicit assignment of teleport-keep group in order to facilitate migrating KEEP users that existed before we added
 	// the teleport-keep group
-	migrateKeepUser := slices.Contains(ui.Groups, types.TeleportKeepGroup)
-	skipKeepGroup := migrateKeepUser && ui.Mode != services.HostUserModeKeep
+	hasKeepGroup := slices.Contains(ui.Groups, types.TeleportKeepGroup)
+	migrateKeepUser := hasKeepGroup && ui.Mode == services.HostUserModeKeep
 
-	if skipKeepGroup {
+	if hasKeepGroup && !migrateKeepUser {
 		log.Warnf("explicit assignment of %q group is not possible in 'insecure-drop' mode", types.TeleportKeepGroup)
 	}
 
@@ -445,7 +448,7 @@ func (u *HostUserManagement) UpsertUser(name string, ui services.HostUsersInfo)
 		case types.TeleportDropGroup, types.TeleportStaticGroup:
 			continue
 		case types.TeleportKeepGroup:
-			if skipKeepGroup {
+			if !migrateKeepUser {
 				continue
 			}
 		}
diff --git a/lib/srv/usermgmt_test.go b/lib/srv/usermgmt_test.go
index 263e96e61341..d2817fe4620c 100644
--- a/lib/srv/usermgmt_test.go
+++ b/lib/srv/usermgmt_test.go
@@ -638,8 +638,8 @@ func Test_DontUpdateUnmanagedUsers(t *testing.T) {
 	}
 }
 
-// teleport-keep can be included explicitly in the Groups slice in order to flag an
-// existing user as being managed by teleport
+// teleport-keep can be included explicitly in the Groups slice, or TakeOwnership can be set on HostUsersInfo,
+// in order to flag an existing user as being managed by teleport.
 func Test_AllowExplicitlyManageExistingUsers(t *testing.T) {
 	t.Parallel()
 
@@ -647,6 +647,7 @@ func Test_AllowExplicitlyManageExistingUsers(t *testing.T) {
 	users, backend := initBackend(t, allGroups)
 
 	assert.NoError(t, backend.CreateUser("alice-keep", []string{}, host.UserOpts{}))
+	assert.NoError(t, backend.CreateUser("alice-static", []string{}, host.UserOpts{}))
 	assert.NoError(t, backend.CreateUser("alice-drop", []string{}, host.UserOpts{}))
 	userinfo := services.HostUsersInfo{
 		Groups: slices.Clone(allGroups),
@@ -662,12 +663,25 @@ func Test_AllowExplicitlyManageExistingUsers(t *testing.T) {
 	assert.ElementsMatch(t, allGroups[:2], backend.users["alice-keep"])
 	assert.NotContains(t, backend.users["alice-keep"], types.TeleportDropGroup)
 
+	// Take ownership of existing user when in STATIC mode
+	userinfo.Mode = services.HostUserModeStatic
+	userinfo.TakeOwnership = true
+	closer, err = users.UpsertUser("alice-static", userinfo)
+	assert.NoError(t, err)
+	assert.Equal(t, nil, closer)
+	assert.Equal(t, 2, backend.setUserGroupsCalls)
+	assert.Contains(t, backend.users["alice-static"], "foo")
+	assert.Contains(t, backend.users["alice-static"], types.TeleportStaticGroup)
+	assert.NotContains(t, backend.users["alice-static"], types.TeleportKeepGroup)
+	assert.NotContains(t, backend.users["alice-static"], types.TeleportDropGroup)
+
 	// Don't take ownership of existing user when in DROP mode
 	userinfo.Mode = services.HostUserModeDrop
+	userinfo.TakeOwnership = false
 	closer, err = users.UpsertUser("alice-drop", userinfo)
 	assert.ErrorIs(t, err, unmanagedUserErr)
 	assert.Equal(t, nil, closer)
-	assert.Equal(t, 1, backend.setUserGroupsCalls)
+	assert.Equal(t, 2, backend.setUserGroupsCalls)
 	assert.Empty(t, backend.users["alice-drop"])
 
 	// Don't assign teleport-keep to users created in DROP mode
@@ -675,7 +689,7 @@ func Test_AllowExplicitlyManageExistingUsers(t *testing.T) {
 	closer, err = users.UpsertUser("bob", userinfo)
 	assert.NoError(t, err)
 	assert.NotEqual(t, nil, closer)
-	assert.Equal(t, 1, backend.setUserGroupsCalls)
+	assert.Equal(t, 2, backend.setUserGroupsCalls)
 	assert.ElementsMatch(t, []string{"foo", types.TeleportDropGroup}, backend.users["bob"])
 	assert.NotContains(t, backend.users["bob"], types.TeleportKeepGroup)
 }