diff --git a/nix/templates/agent-base.nix b/nix/templates/agent-base.nix
index 1894998e..ffbc826b 100644
--- a/nix/templates/agent-base.nix
+++ b/nix/templates/agent-base.nix
@@ -45,7 +45,7 @@ in
       # `+` runs ExecStartPre as root (before the User= drop) so
       # we can chown the bind onto the agent user every start —
       # robust against activation-script timing on first boot.
-      ExecStartPre = "+${pkgs.coreutils}/bin/chown ${userName}:${userName} /run/hive";
+      ExecStartPre = "+${pkgs.coreutils}/bin/chown -R ${userName}:${userName} /run/hive";
       # Run the harness as the per-agent user (#658). claude itself
       # spawned by the harness then runs as that user too — drops
       # root inside the container while sudo (`NOPASSWD: ALL` by
diff --git a/nix/templates/manager.nix b/nix/templates/manager.nix
index 5fa7fd15..394ab374 100644
--- a/nix/templates/manager.nix
+++ b/nix/templates/manager.nix
@@ -55,7 +55,7 @@ in
       # `+` runs ExecStartPre as root (before the User= drop) so
       # we can chown the bind onto the agent user every start —
       # robust against activation-script timing on first boot.
-      ExecStartPre = "+${pkgs.coreutils}/bin/chown ${userName}:${userName} /run/hive";
+      ExecStartPre = "+${pkgs.coreutils}/bin/chown -R ${userName}:${userName} /run/hive";
       # Same drop-from-root as agent-base.nix (#658). Manager
       # interactions with the host (rebuild approvals, config
       # writes) still happen via the dedicated unix sockets