diff --git a/Dockerfile.service b/Dockerfile.service
index b15734e..08fd21f 100644
--- a/Dockerfile.service
+++ b/Dockerfile.service
@@ -81,7 +81,8 @@ WORKDIR /app/packages/services/${SERVICE_NAME}
 
 # Run as non-root user (required for SDK bypassPermissions mode)
 RUN adduser -D -h /home/appuser appuser && \
-    chown -R appuser:appuser /app
+    mkdir -p /data/claude-tenants && \
+    chown -R appuser:appuser /app /data/claude-tenants
 USER appuser
 
 ARG SERVICE_PORT=3000