diff --git a/scripts/deploy_accounting_prod.py b/scripts/deploy_accounting_prod.py
index a791eae..38fe4ed 100644
--- a/scripts/deploy_accounting_prod.py
+++ b/scripts/deploy_accounting_prod.py
@@ -169,17 +169,23 @@ def main() -> int:
         run(app, f"mkdir -p {REMOTE_DIR}")
         upload_file(app, tarball, "/tmp/torbatyar_accounting_bundle.tar.gz")
         # Preserve remote .env while extracting
+        # Preserve remote .env while extracting (fix docker-owned file perms with sudo)
         code, _ = run(
             app,
             f"""
 set -e
 cd {REMOTE_DIR}
 if [ -f .env ]; then cp .env /tmp/torbatyar.env.bak; fi
-tar -xzf /tmp/torbatyar_accounting_bundle.tar.gz -C {REMOTE_DIR}
+chown -R {APP_USER}:{APP_USER} {REMOTE_DIR}/frontend {REMOTE_DIR}/backend {REMOTE_DIR}/docker-compose.yml 2>/dev/null || true
+chmod -R u+rwX {REMOTE_DIR}/frontend {REMOTE_DIR}/backend 2>/dev/null || true
+tar --overwrite -xzf /tmp/torbatyar_accounting_bundle.tar.gz -C {REMOTE_DIR}
 if [ -f /tmp/torbatyar.env.bak ]; then cp /tmp/torbatyar.env.bak .env; fi
+chown -R {APP_USER}:{APP_USER} {REMOTE_DIR}/frontend {REMOTE_DIR}/backend 2>/dev/null || true
 rm -f /tmp/torbatyar_accounting_bundle.tar.gz
 ls -la {REMOTE_DIR} | head
 """,
+            sudo=True,
+            password=APP_PASS,
             timeout=300,
         )
         if code != 0: