diff --git a/install.sh b/install.sh
index baeba4e..90dc85e 100755
--- a/install.sh
+++ b/install.sh
@@ -162,6 +162,9 @@ ProtectSystem=full
 ProtectHome=true
 PrivateTmp=true
 
+# Data and logs directories need write access (overrides ProtectSystem=full)
+ReadWritePaths=${DATA_DIR} ${LOGS_DIR}
+
 [Install]
 WantedBy=multi-user.target
 UNITEOF
@@ -182,8 +185,8 @@ systemctl daemon-reload
 info "Enabling ${SERVICE_NAME} service (starts on boot)..."
 systemctl enable "${SERVICE_NAME}"
 
-info "Starting ${SERVICE_NAME} service..."
-systemctl start "${SERVICE_NAME}"
+info "Starting ${SERVICE_NAME} service (with 30s timeout)..."
+timeout 30 systemctl start "${SERVICE_NAME}" || warn "'systemctl start ${SERVICE_NAME}' timed out or failed — the service may need manual investigation"
 
 # Brief pause so the service can initialise
 sleep 2