Actually you were right (so I am sorry).

What I tried before I posted my question here was setting $< and that makes the process still appear as being run by root.

But setting $> does the trick and is all that is needed.

Seems I need to brush up on real vs effective uid...