diff --git a/lib/extract-stream.js b/lib/extract-stream.js
index 97c3a56..eb6e75b 100644
--- a/lib/extract-stream.js
+++ b/lib/extract-stream.js
@@ -10,24 +10,14 @@ function extractStream (dest, opts, cb) {
     filter: (name, entry) => !entry.header.type.match(/^.*link$/i),
     strip: 1,
     onwarn: msg => opts.log && opts.log.warn('tar', msg),
-    onentry: makeOnEntry(opts),
-    preserveOwner: opts.uid != null || opts.gid != null
+    uid: opts.uid,
+    gid: opts.gid,
+    onentry (entry) {
+      if (entry.type.toLowerCase() === 'file') {
+        entry.mode = opts.fmode & ~(opts.umask || 0)
+      } else if (entry.type.toLowerCase() === 'directory') {
+        entry.mode = opts.dmode & ~(opts.umask || 0)
+      }
+    }
   })
 }
-
-function makeOnEntry (opts) {
-  const sawEntry = {}
-  return entry => _onentry(entry, sawEntry, opts)
-}
-
-function _onentry (entry, sawIgnores, opts) {
-  if (process.getuid) {
-    entry.uid = opts.uid == null ? entry.uid : opts.uid
-    entry.gid = opts.gid == null ? entry.gid : opts.gid
-  }
-  if (entry.type.toLowerCase() === 'file') {
-    entry.mode = opts.fmode & ~(opts.umask || 0)
-  } else if (entry.type.toLowerCase() === 'directory') {
-    entry.mode = opts.dmode & ~(opts.umask || 0)
-  }
-}
diff --git a/package-lock.json b/package-lock.json
index ca159eb..ca03c8f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5534,10 +5534,11 @@
       }
     },
     "tar": {
-      "version": "3.1.13",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-3.1.13.tgz",
-      "integrity": "sha512-jDTf6d8VGRRNdYF6DjsagbRKy7LQvjXs0VuqzoJoSJXRY/wUlVttR8Ciz+sULGzLldKxbkCQAHfi0cpVpPdDmw==",
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-3.2.0.tgz",
+      "integrity": "sha512-YRHTZzumkYuLx/lXsWZVowi9WrYbOQvxbEDtuFjq+LPCtLLGleWLkL/pdCnTwZMA92+Vg3UwVRBjpVQNcg6H3A==",
       "requires": {
+        "chownr": "1.0.1",
         "minipass": "2.2.1",
         "minizlib": "1.0.3",
         "mkdirp": "0.5.1",
diff --git a/package.json b/package.json
index 1b6fb45..df1c2a0 100644
--- a/package.json
+++ b/package.json
@@ -59,7 +59,7 @@
     "safe-buffer": "^5.1.1",
     "semver": "^5.4.1",
     "ssri": "^4.1.6",
-    "tar": "^3.1.13",
+    "tar": "^3.2.0",
     "unique-filename": "^1.1.0",
     "which": "^1.3.0"
   },
diff --git a/test/extract-stream.chown.js b/test/extract-stream.chown.js
index ae49cce..184eda3 100644
--- a/test/extract-stream.chown.js
+++ b/test/extract-stream.chown.js
@@ -55,6 +55,8 @@ test('accepts gid and uid opts', {skip: !process.getuid}, t => {
     }))
   }).then(() => {
     t.deepEqual(updatedPaths, [
+      'target',
+      'target/foo',
       'target/package.json',
       'target/foo/index.js'
     ], 'extracted files had correct uid/gid set')