diff --git a/scripts/source/loading/scan_files.sh b/scripts/source/loading/scan_files.sh
index c1145c4..77297ed 100755
--- a/scripts/source/loading/scan_files.sh
+++ b/scripts/source/loading/scan_files.sh
@@ -53,6 +53,14 @@ sourceScanFiles()
     # and not list-readable by the manager), so enumerate them AS that user via
     # runFileOp; the manager still sources each (the .config files are o+r). The
     # 'containers' install templates are manager-owned, so a plain find suffices.
+    #
+    # Unreadable dirs are PRUNED, not descended into: an app's container-created
+    # data dirs are owned by the container's (sub)uid and mode 0700 — e.g.
+    # containers/<app>/postgres, uid 231141 under rootless — so even the docker
+    # install user can't list them, and find would print a "Permission denied"
+    # line per dir straight into the middle of every install's output. They never
+    # hold a LibrePortal .config, so skipping them loses nothing; pruning (rather
+    # than discarding stderr) keeps genuine find errors visible.
     if [ "$load_type" != "libreportal_configs" ]; then
         local scan_op=""
         [[ "$load_type" == "app_configs" ]] && scan_op="runFileOp"
@@ -61,7 +69,7 @@ sourceScanFiles()
                 source "$file"
                 # echo "$load_type FILE $file"
             fi
-        done < <($scan_op find "$folder_dir" -maxdepth 3 -type d \( -name 'resources' \) -prune -o -type f -name "$file_pattern" -print0)
+        done < <($scan_op find "$folder_dir" -maxdepth 3 \( -type d \( -name 'resources' -o ! -readable -o ! -executable \) -prune \) -o -type f -name "$file_pattern" -print0)
     fi
 
     # Load the categories from the file into an array