diff --git a/deploy/Dockerfile b/deploy/Dockerfile
index 3549c3b..34d1cda 100644
--- a/deploy/Dockerfile
+++ b/deploy/Dockerfile
@@ -59,7 +59,9 @@ RUN npm install --global --omit=dev "opencode-ai@${OPENCODE_VERSION}" \
     && rm -f "/tmp/${asset}" /tmp/gitea-mcp
 
 COPY opencode /opt/ci-agents/opencode
-RUN chmod -R a-w /opt/ci-agents
+RUN chmod -R a-w /opt/ci-agents \
+       && chown ci-agent /opt/ci-agents/empty-config/opencode \
+       && chmod u+w /opt/ci-agents/empty-config/opencode
 
 ENV XDG_DATA_HOME=/var/lib/opencode-agent/data \
     XDG_CONFIG_HOME=/opt/ci-agents/empty-config \