diff --git a/scripts/config/core/config_update_option.sh b/scripts/config/core/config_update_option.sh
index 1fa71da..4a21973 100755
--- a/scripts/config/core/config_update_option.sh
+++ b/scripts/config/core/config_update_option.sh
@@ -28,7 +28,22 @@ updateConfigOption()
     local escaped_value
     escaped_value=$(printf '%s' "$config_value" | sed -e 's/[\\&"]/\\&/g')
 
-    # Check if config option exists in the file
+    # Pick the right de-sudo helper based on which tree the config lives in.
+    # Manager (libreportal) owns /libreportal-system/configs/* and runs the
+    # CLI; dockerinstall owns /libreportal-containers/<app>/* in rootless mode.
+    # Without this, `sed -i` on a containers-owned <app>.config fails with
+    #   sed: couldn't open temporary file /libreportal-containers/<app>/sedXXXX: Permission denied
+    # (sed -i writes its temp next to the target, so it inherits the dir's
+    # write perms — and the manager can't write inside dockerinstall dirs).
+    # runFileOp routes the write through the right user.
+    local _write_op="runInstallOp"
+    if [[ -n "${containers_dir:-}" && "$config_file" == "${containers_dir%/}/"* ]]; then
+        _write_op="runFileOp"
+    fi
+
+    # Check if config option exists in the file. grep + read can use the
+    # current user — both dirs are world-readable; only the write needs
+    # escalation.
     if grep -q "^$config_option=" "$config_file"; then
         # Extract the comment part first (everything after the first #)
         local original_line=$(grep "^$config_option=" "$config_file")
@@ -36,9 +51,9 @@ updateConfigOption()
 
         # Replace the value, preserving comment if it existed. Always quoted.
         if [[ -n "$comment_part" ]]; then
-            sed -i "s${DELIM}^${config_option}=.*${DELIM}${config_option}=\"${escaped_value}\"                     ${comment_part}${DELIM}" "$config_file"
+            $_write_op sed -i "s${DELIM}^${config_option}=.*${DELIM}${config_option}=\"${escaped_value}\"                     ${comment_part}${DELIM}" "$config_file"
         else
-            sed -i "s${DELIM}^${config_option}=.*${DELIM}${config_option}=\"${escaped_value}\"${DELIM}" "$config_file"
+            $_write_op sed -i "s${DELIM}^${config_option}=.*${DELIM}${config_option}=\"${escaped_value}\"${DELIM}" "$config_file"
         fi
         checkSuccess "Updated $config_option to $config_value"
         source "$config_file"