diff --git a/scripts/docker/compose/copy_build_context.sh b/scripts/docker/compose/copy_build_context.sh
index c31153b..0ef1380 100644
--- a/scripts/docker/compose/copy_build_context.sh
+++ b/scripts/docker/compose/copy_build_context.sh
@@ -36,8 +36,12 @@ dockerCopyBuildContext()
     # Use rsync if available so re-installs only diff what changed; fall
     # back to cp -R for systems without rsync. Either way we exclude the
     # files that have their own copy lifecycle.
+    # --no-owner --no-group: don't carry the install template's ownership (the
+    # repo clone is owned by the human user, uid ~1000) onto the deployed
+    # container dir — the chown below sets the correct owner. Without this the
+    # rsync re-stamps the WebUI tree as uid 1000 every install.
     if command -v rsync >/dev/null 2>&1; then
-        sudo rsync -a \
+        sudo rsync -a --no-owner --no-group \
             --exclude="docker-compose.yml" \
             --exclude="docker-compose.${app_name}.yml" \
             --exclude="${app_name}.config" \
@@ -52,6 +56,11 @@ dockerCopyBuildContext()
         sudo rm -f "$target_dir/${app_name}.config" "$target_dir/${app_name}.tools.json"
     fi
 
-    sudo chown -R "$docker_install_user:$docker_install_user" "$target_dir"
+    # Own the deployed tree as the mode's container owner (config-authoritative,
+    # never the stale/empty $docker_install_user global that let uid 1000 slip
+    # through before).
+    local owner
+    owner="$(dockerContainerOwner)"
+    runSystem chown -R "$owner:$owner" "$target_dir"
     isSuccessful "Build context copied for $app_name."
 }