diff --git a/packages/services/agent-service/src/infrastructure/services/agent-instance-deploy.service.ts b/packages/services/agent-service/src/infrastructure/services/agent-instance-deploy.service.ts
index 705ce3d..f0b5320 100644
--- a/packages/services/agent-service/src/infrastructure/services/agent-instance-deploy.service.ts
+++ b/packages/services/agent-service/src/infrastructure/services/agent-instance-deploy.service.ts
@@ -212,6 +212,9 @@ export class AgentInstanceDeployService {
     });
     await this.sshExec(sshCreds, `mkdir -p /data/openclaw/${instance.id}/agents/main/agent && printf '%s' '${authProfiles.replace(/'/g, "'\\''")}' > /data/openclaw/${instance.id}/agents/main/agent/auth-profiles.json`);
 
+    // Pre-create workspace dir and fix ownership so the container (running as node uid=1000) can write
+    await this.sshExec(sshCreds, `mkdir -p /data/openclaw/${instance.id}/workspace && chown -R 1000:1000 /data/openclaw/${instance.id}`);
+
     const cmd = [
       'docker run -d',
       `--name ${instance.containerName}`,