diff --git a/scripts/setup.sh b/scripts/setup.sh
index 8775ef1b..c52ed6a1 100755
--- a/scripts/setup.sh
+++ b/scripts/setup.sh
@@ -63,6 +63,14 @@ else
   ok "added $USER to officerdev group"
 fi
 
+# Ensure provisioned users can traverse to data directories
+if [ "$(stat -c '%A' "$HOME" | cut -c10)" = "x" ]; then
+  skip "home dir traversable"
+else
+  chmod o+x "$HOME"
+  ok "made home dir traversable (o+x)"
+fi
+
 # ─── 1. core system packages ───────────────────────────────────────────────────
 echo ""
 echo "── Core system packages ──"
diff --git a/src/servers/api/users/provision.ts b/src/servers/api/users/provision.ts
index 135351cc..19ee64ce 100644
--- a/src/servers/api/users/provision.ts
+++ b/src/servers/api/users/provision.ts
@@ -84,10 +84,10 @@ export async function provisionLinuxUser(email: string, username: string): Promi
   await Bun.write(join(claudeDir, 'settings.json'), settingsContent);
 
   // Service user (pastilhas) owns everything — server can always read/write.
-  // Linux user gets group access via officerdev for terminal sessions only.
+  // User's personal group gives only that user terminal access. Others get nothing.
   const serviceUser = process.env.USER ?? 'pastilhas';
-  run(['sudo', 'chown', '-R', `${serviceUser}:${SHARED_GROUP}`, userRoot]);
-  run(['sudo', 'chmod', '-R', '2775', userRoot]);
+  run(['sudo', 'chown', '-R', `${serviceUser}:${shellUsername}`, userRoot]);
+  run(['sudo', 'chmod', '-R', '2770', userRoot]);
 
   console.log(`[provision] provisioning complete for ${shellUsername}`);
   return true;