diff --git a/scripts/config/tags/manager/tags_manager_update.sh b/scripts/config/tags/manager/tags_manager_update.sh
index 107a670..aa047ab 100755
--- a/scripts/config/tags/manager/tags_manager_update.sh
+++ b/scripts/config/tags/manager/tags_manager_update.sh
@@ -45,9 +45,12 @@ tagsManagerUpdateUniversalTag()
     esc_placeholder=$(printf '%s' "$current_placeholder" | sed 's/[][\\.*^$/|]/\\&/g')
     esc_new=$(printf '%s' "$new_content" | sed 's/[\\&|]/\\&/g')
 
-    # Single-pass substitution, scoped to lines carrying this tag's
-    # annotation. The annotation's default-value field and any matching
-    # placeholder in the body of the same line both update together
-    # (they start identical and stay identical after each call).
-    sed -i "/#LIBREPORTAL|${tag_name}|/s|${esc_placeholder}|${esc_new}|g" "$file_path"
+    # Single-pass substitution, scoped to lines carrying this tag's annotation.
+    # The in-place edit runs AS the file's owner (no root): under
+    # /docker/containers/<app> that's the docker install user (runFileOp); the
+    # manager-owned configs/ + install templates use runInstallOp. The read
+    # (awk above) needs no escalation — config/compose files are world-readable.
+    local op="runInstallOp"
+    [[ "$file_path" == "$containers_dir"* || "$file_path" == /docker/containers/* ]] && op="runFileOp"
+    $op sed -i "/#LIBREPORTAL|${tag_name}|/s|${esc_placeholder}|${esc_new}|g" "$file_path"
 }