diff --git a/lib/tiny-cloud/user-data/alpine-config b/lib/tiny-cloud/user-data/alpine-config
index 814826b..3b2b51a 100644
--- a/lib/tiny-cloud/user-data/alpine-config
+++ b/lib/tiny-cloud/user-data/alpine-config
@@ -270,7 +270,7 @@ in_list() {
 init__userdata_users() {
 	local users="$(get_userdata users)"
 	for i in $users; do
-		local name gecos homedir shell groups
+		local name gecos homedir shell primary_group groups
 		local system=false no_create_home=false lock_passwd=true
 		local keys="$(get_userdata users/$i)"
 		if [ "$i" = 1 ] && [ "$keys" = "default" ]; then
@@ -290,6 +290,9 @@ init__userdata_users() {
 		if in_list shell $keys; then
 			shell="$(get_userdata users/$i/shell)"
 		fi
+		if in_list primary_group $keys; then
+			primary_group="$(get_userdata users/$i/primary_group)"
+		fi
 		if in_list system $keys; then
 			system="$(get_userdata users/$i/system)"
 		fi
@@ -306,7 +309,7 @@ init__userdata_users() {
 			if [ "$no_create_home" != "true" ]; then
 				unset no_create_home
 			fi
-			$MOCK adduser -D ${gecos:+-g "$gecos"} ${homedir:+-h "$homedir"} ${shell:+-s "$shell"} ${system:+-S} ${no_create_home:+-H} "$name"
+			$MOCK adduser -D ${gecos:+-g "$gecos"} ${homedir:+-h "$homedir"} ${shell:+-s "$shell"} ${primary_group:+-G "$primary_group"} ${system:+-S} ${no_create_home:+-H} "$name"
 		fi
 
 		if in_list lock_passwd $keys; then
diff --git a/tests/tiny-cloud-alpine.test b/tests/tiny-cloud-alpine.test
index 815e29d..fe3bcbe 100755
--- a/tests/tiny-cloud-alpine.test
+++ b/tests/tiny-cloud-alpine.test
@@ -22,6 +22,7 @@ init_tests \
 	userdata_users_gecos \
 	userdata_users_homedir \
 	userdata_users_shell \
+	userdata_users_primary_group \
 	userdata_users_system \
 	userdata_users_no_create_home \
 	userdata_users_groups \
@@ -250,6 +251,22 @@ userdata_users_shell_body() {
 		tiny-cloud main
 }
 
+userdata_users_primary_group_body() {
+	# first specified user will replace default user
+	fake_userdata_nocloud <<-EOF
+		#alpine-config
+		users:
+		  - default
+		  - name: foo
+		    primary_group: wheel
+	EOF
+	atf_check -e ignore -o ignore tiny-cloud early
+	atf_check \
+		-e match:"userdata_users: done" \
+		-o match:"adduser.*-G wheel.*foo" \
+		tiny-cloud main
+}
+
 userdata_users_system_body() {
 	# first specified user will replace default user
 	fake_userdata_nocloud <<-EOF