diff --git a/deploy/petal.env.example b/deploy/petal.env.example
index 372439f..1f2f06e 100644
--- a/deploy/petal.env.example
+++ b/deploy/petal.env.example
@@ -14,6 +14,12 @@ BASE_URL=https://petal.parodia.dev
 # The companion's bedtime nag and the night theme read the container clock.
 TZ=Europe/Lisbon
 
+# The container runs as this uid/gid so it can write the ./data bind mount.
+# Set both to the output of `id -u` / `id -g` for the account owning the stack
+# directory. Wrong values show up as "unable to open database file (14)".
+PETAL_UID=1001
+PETAL_GID=1001
+
 # --- LLM (millenia, over headscale) ------------------------------------------
 # The only cross-VPN dependency. Petal degrades warmly when it's unreachable:
 # spell check, gloss, garden, search, export and read-aloud all keep working and
diff --git a/docker-compose.yml b/docker-compose.yml
index c62d83b..6d498ff 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -24,6 +24,13 @@ services:
     image: petal:local
     container_name: petal
     restart: unless-stopped
+    # ./data is a bind mount, so the image's own `petal` user (uid 10001) has no
+    # claim on it — the host's ownership wins and the container can't open
+    # petal.db. Run as whoever owns the stack directory instead. Keeping it the
+    # host user (rather than chowning ./data to 10001) is deliberate: the backup
+    # script gzips snapshots in place from the host, so the host account needs
+    # write access to the same directory. Still never root.
+    user: "${PETAL_UID:-1001}:${PETAL_GID:-1001}"
     env_file: .env
     environment:
       # Fixed by the image layout; kept here so they're visible at a glance.