diff --git a/install.sh b/install.sh
index f0a0035..66c2d54 100755
--- a/install.sh
+++ b/install.sh
@@ -261,7 +261,31 @@ fi
 sudo_if chmod 600 "$INSTALL_DIR/.env"
 info "Configuration saved to $INSTALL_DIR/.env"
 
-# ── 8. Systemd service ───────────────────────────────────────────
+# ── 8. Determine app user ──────────────────────────────────────────
+# Detect the real user (the one who invoked the script, not root via sudo)
+APP_USER="${SUDO_USER:-$(whoami)}"
+# If still root, create a dedicated system user
+if [ "$APP_USER" = "root" ]; then
+    APP_USER="${SERVICE_NAME}"
+    if ! id -u "${APP_USER}" &>/dev/null 2>&1; then
+        info "Creating system user '${APP_USER}'..."
+        sudo_if useradd --system --no-create-home --home-dir "${INSTALL_DIR}" --shell /usr/sbin/nologin "${APP_USER}"
+    fi
+else
+    info "Using existing user '${APP_USER}'"
+    # Add user to ollama group if it exists (so they can run ollama CLI)
+    if getent group ollama &>/dev/null; then
+        sudo_if usermod -aG ollama "${APP_USER}" 2>/dev/null || true
+    fi
+fi
+
+# ── 9. Set ownership ───────────────────────────────────────────────
+sudo_if chown -R "${APP_USER}:${APP_USER}" "${INSTALL_DIR}"
+sudo_if chmod 755 "${INSTALL_DIR}" "${INSTALL_DIR}/templates" "${INSTALL_DIR}/static"
+# Storage needs write permission for uploaded receipts
+sudo_if chmod 775 "${INSTALL_DIR}/storage"
+
+# ── 10. Systemd service ────────────────────────────────────────────
 info "Creating systemd service..."
 sudo_if tee "/etc/systemd/system/${SERVICE_NAME}.service" > /dev/null << SERVEOF
 [Unit]
@@ -272,7 +296,8 @@ Wants=ollama.service
 
 [Service]
 Type=simple
-User=root
+User=${APP_USER}
+Group=${APP_USER}
 WorkingDirectory=${INSTALL_DIR}
 ExecStart=${INSTALL_DIR}/receiptnext
 Restart=always