diff --git a/deploy/codex-worker.sh b/deploy/codex-worker.sh
index 8e39da9..2747092 100644
--- a/deploy/codex-worker.sh
+++ b/deploy/codex-worker.sh
@@ -7,7 +7,8 @@ binary=$(realpath "$1")
 test -x "$binary"
 test -s "$dir/home/auth.json"
 test -s "$dir/grants/projects.json"
-install -d -m 700 -o 1000 -g 1000 "$dir/run"
+install -d -m 700 "$dir/run"
+chown 1000:1000 "$dir/run"
 
 # The host operator supplies an isolated Codex home and starts a single worker.
 # The Docker default bridge supplies egress independently of Foundry's network.