diff --git a/deploy/provision-tenants.sh b/deploy/provision-tenants.sh
index e0402d0..6ef2c32 100755
--- a/deploy/provision-tenants.sh
+++ b/deploy/provision-tenants.sh
@@ -49,6 +49,11 @@ run_container() { # slug port
     --label quorla.tenant="$slug" --label quorla.port="$port" "$IMAGE" >/dev/null
 }
 
+fix_owner() { # dir: the app runs as "node" (uid 1000) inside the image; hand it the folders it writes (no sudo needed)
+  [ "$(stat -c %u "$1/data")" = "1000" ] && return 0
+  docker run --rm --user 0 --entrypoint chown -v "$1:/t" "$IMAGE" -R 1000:1000 /t/data /t/clients /t/team /t/reports /t/branding
+}
+
 wait_healthy() { # port
   for _ in $(seq 1 30); do curl -fsS -m 3 "http://127.0.0.1:$1/api/auth/me" >/dev/null 2>&1 && return 0; sleep 2; done
   return 1
@@ -74,6 +79,7 @@ while IFS=$'\t' read -r slug desired port name token; do
       mkdir -p "$dir"/{data,clients,team,reports,backups}
       [ -d "$dir/branding" ] || cp -r "$REPO/branding" "$dir/branding"
       write_env "$slug" "$name" "$token"
+      fix_owner "$dir"
       if docker inspect "quorla-$slug" >/dev/null 2>&1; then docker start "quorla-$slug" >/dev/null; else run_container "$slug" "$port"; fi
       if wait_healthy "$port"; then log "$slug running on $port"; report "$slug" '{"actual":"running"}';
       else log "$slug did not start"; report "$slug" "{\"error\":\"container did not become healthy on port $port\"}"; fi