diff --git a/pkg/cluster/cluster.go b/pkg/cluster/cluster.go
index 96c5c21be..f5c8a3b01 100644
--- a/pkg/cluster/cluster.go
+++ b/pkg/cluster/cluster.go
@@ -610,12 +610,12 @@ func (c *Cluster) initSystemUsers() {
 func (c *Cluster) initRobotUsers() error {
 	for username, userFlags := range c.Spec.Users {
 		if !isValidUsername(username) {
-			return fmt.Errorf("invalid username: '%v'", username)
+			return fmt.Errorf("invalid username: %q", username)
 		}
 
 		flags, err := normalizeUserFlags(userFlags)
 		if err != nil {
-			return fmt.Errorf("invalid flags for user '%v': %v", username, err)
+			return fmt.Errorf("invalid flags for user %q: %v", username, err)
 		}
 		if _, present := c.pgUsers[username]; !present {
 			c.pgUsers[username] = spec.PgUser{
@@ -630,6 +630,7 @@ func (c *Cluster) initRobotUsers() error {
 			c.logger.Debugf("merging user %q data", username)
 			user := c.pgUsers[username]
 			user.Flags = flags
+			c.pgUsers[username] = user
 		}
 	}
 
diff --git a/pkg/cluster/util.go b/pkg/cluster/util.go
index 3f2f9fee8..257601ed7 100644
--- a/pkg/cluster/util.go
+++ b/pkg/cluster/util.go
@@ -17,6 +17,7 @@ import (
 	"github.com/zalando-incubator/postgres-operator/pkg/util"
 	"github.com/zalando-incubator/postgres-operator/pkg/util/constants"
 	"github.com/zalando-incubator/postgres-operator/pkg/util/retryutil"
+	"sort"
 )
 
 func isValidUsername(username string) bool {
@@ -77,7 +78,7 @@ func normalizeUserFlags(userFlags []string) ([]string, error) {
 	if addLogin {
 		flags = append(flags, constants.RoleFlagLogin)
 	}
-
+	sort.Strings(flags)
 	return flags, nil
 }
 
diff --git a/pkg/spec/postgresql.go b/pkg/spec/postgresql.go
index 555784ab0..a08d260d6 100644
--- a/pkg/spec/postgresql.go
+++ b/pkg/spec/postgresql.go
@@ -58,7 +58,7 @@ type CloneDescription struct {
 	EndTimestamp string `json:"timestamp,omitempty"`
 }
 
-type userFlags []string
+type UserFlags []string
 
 // PostgresStatus contains status of the PostgreSQL cluster (running, creation failed etc.)
 type PostgresStatus string
@@ -99,7 +99,7 @@ type PostgresSpec struct {
 	UseLoadBalancer     *bool                `json:"useLoadBalancer,omitempty"`
 	ReplicaLoadBalancer bool                 `json:"replicaLoadBalancer,omitempty"`
 	NumberOfInstances   int32                `json:"numberOfInstances"`
-	Users               map[string]userFlags `json:"users"`
+	Users               map[string]UserFlags `json:"users"`
 	MaintenanceWindows  []MaintenanceWindow  `json:"maintenanceWindows,omitempty"`
 	Clone               CloneDescription     `json:"clone"`
 	ClusterName         string               `json:"-"`
diff --git a/pkg/spec/postgresql_test.go b/pkg/spec/postgresql_test.go
index 07a040ee1..091334e8e 100644
--- a/pkg/spec/postgresql_test.go
+++ b/pkg/spec/postgresql_test.go
@@ -226,7 +226,7 @@ var unmarshalCluster = []struct {
 				TeamID:              "ACID",
 				AllowedSourceRanges: []string{"127.0.0.1/32"},
 				NumberOfInstances:   2,
-				Users:               map[string]userFlags{"zalando": {"superuser", "createdb"}},
+				Users:               map[string]UserFlags{"zalando": {"superuser", "createdb"}},
 				MaintenanceWindows: []MaintenanceWindow{{
 					Everyday:  false,
 					Weekday:   time.Monday,