diff --git a/scripts/function/permission/libreportal_folders.sh b/scripts/function/permission/libreportal_folders.sh
index 9951365..b3ecfb8 100755
--- a/scripts/function/permission/libreportal_folders.sh
+++ b/scripts/function/permission/libreportal_folders.sh
@@ -35,9 +35,13 @@ reconcileDockerOwnership()
     local logdir="${logs_dir:-$ddir/logs/}"
     local scrdir="${script_dir:-$ddir/install}"
     local dbpath="$ddir/${db_file:-database.db}"
-    local appusr="${docker_install_user:-${CFG_DOCKER_INSTALL_USER:-}}"
-    [[ -z "$appusr" ]] && appusr=$(grep -h '^CFG_DOCKER_INSTALL_USER=' "$cfgdir/general/general_docker_install" 2>/dev/null | head -1 | cut -d= -f2 | awk '{print $1}')
-    appusr="${appusr:-dockerinstall}"
+    # Read the rootless docker install user AUTHORITATIVELY from config — NOT the
+    # lowercase $docker_install_user global, which check_install_type.sh sets to
+    # the MANAGER user in rooted mode, so during a rooted->rootless switch it's
+    # stale (=manager) and would mis-own the WebUI dir.
+    local appusr
+    appusr=$(grep -h '^CFG_DOCKER_INSTALL_USER=' "$cfgdir/general/general_docker_install" 2>/dev/null | head -1 | cut -d= -f2 | awk '{print $1}')
+    appusr="${appusr:-${CFG_DOCKER_INSTALL_USER:-dockerinstall}}"
 
     [[ -d "$ddir" ]] || return 0