diff --git a/containers/matrix/scripts/matrix_install_hooks.sh b/containers/matrix/scripts/matrix_install_hooks.sh
index 68ca98f..6af588b 100644
--- a/containers/matrix/scripts/matrix_install_hooks.sh
+++ b/containers/matrix/scripts/matrix_install_hooks.sh
@@ -238,7 +238,15 @@ matrix_install_post_compose()
     checkSuccess "Writing homeserver.yaml (server_name=$server_name registration=$enable_registration)"
 
     runFileOp chmod 600 "$homeserver_file" "$data_dir/signing.key"
-    runFileOp chown -R "$docker_install_user":"$docker_install_user" "$data_dir"
+    # Top-level files only (homeserver.yaml, log.yaml, signing.key, the admin
+    # token) — the ones this hook writes and the step name refers to. The
+    # recursion this replaces also walked data/media_store, whose contents belong
+    # to Synapse. That is harmless under rootless, where container-root maps to
+    # the docker install user, but in ROOTED mode those files are host-root and
+    # the chown runs as the manager: "Operation not permitted" per file plus a
+    # failed step, for files that must keep their own ownership regardless.
+    runFileOp find "$data_dir" -maxdepth 1 -type f \
+        -exec chown "$docker_install_user":"$docker_install_user" {} +
     checkSuccess "Restricting permissions on the Synapse secrets"
 
 }