diff --git a/tools/nextwks.sh b/tools/nextwks.sh
index 1dc9b5f..cab3e95 100755
--- a/tools/nextwks.sh
+++ b/tools/nextwks.sh
@@ -27,6 +27,11 @@ if [ "$(id -u)" -ne 0 ]; then
     exec sudo bash "$(realpath "$0")" "$@"
 fi
 
+# Determine the non-root user for file ownership
+RUN_USER="${SUDO_USER:-${USER:-master}}"
+RUN_UID=$(id -u "$RUN_USER" 2>/dev/null || echo 1000)
+RUN_GID=$(id -g "$RUN_USER" 2>/dev/null || echo 1000)
+
 # --- Load existing env (if any) ---
 if [ -f "$BACKUP_DIR/.env" ]; then
     set -a; source "$BACKUP_DIR/.env"; set +a
@@ -213,7 +218,14 @@ if [ "$MODE" != "update" ]; then
 fi
 
 # ============================================================
-# 8. STOP old containers (all modes)
+# 8. FIX OWNERSHIP — chown to the non-root user
+# ============================================================
+echo "[*] Setting file ownership to $RUN_USER..."
+chown -R "$RUN_UID:$RUN_GID" "$TARGET_DIR" 2>/dev/null || true
+chown -R "$RUN_UID:$RUN_GID" "$BACKUP_DIR" 2>/dev/null || true
+
+# ============================================================
+# 9. STOP old containers (all modes)
 # ============================================================
 echo "[*] Stopping any previous containers..."
 for c in caddy authelia launcher; do
@@ -223,7 +235,7 @@ done
 sleep 1
 
 # ============================================================
-# 9. PORT CHECK — before deploy
+# 10. PORT CHECK — before deploy
 # ============================================================
 if ss -tlnp 2>/dev/null | grep -q ':80 '; then
     echo "=============================================="
@@ -248,7 +260,7 @@ if ss -tlnp 2>/dev/null | grep -q ':80 '; then
 fi
 
 # ============================================================
-# 10. DEPLOY stack
+# 11. DEPLOY stack
 # ============================================================
 echo "[*] Deploying containers on $NETWORK_NAME..."