diff --git a/nix/module-eval/agent-user.nix b/nix/module-eval/agent-user.nix
index 7a076a3d..6c5f5af3 100644
--- a/nix/module-eval/agent-user.nix
+++ b/nix/module-eval/agent-user.nix
@@ -32,7 +32,18 @@ let
       name = "the agent's activation hands its own work dir to the agent user";
       ok =
         lib.hasInfix ''if [ "$(stat -c %U "/agents/$userName/work")" != "$userName" ]; then'' migrate
-        && lib.hasInfix ''chown -hR "$userName:$userName" "/agents/$userName/work"'' migrate;
+        && lib.hasInfix ''heal_own_dir "/agents/$userName/work"'' migrate;
+    }
+    {
+      # The helper is the only recursive chown of these dirs; it must hand the
+      # tree to the agent user and log a failure rather than discard it.
+      name = "the agent's activation hands state, harness and .claude to the agent user, logging failures";
+      ok =
+        lib.hasInfix ''chown -hR "$userName:$userName" "$1" 2>&1'' migrate
+        && lib.hasInfix "could not chown $1 to $userName" migrate
+        && lib.hasInfix ''heal_own_dir "/agents/$userName/state"'' migrate
+        && lib.hasInfix ''heal_own_dir "/agents/$userName/harness"'' migrate
+        && lib.hasInfix ''heal_own_dir "$homeDir/.claude"'' migrate;
     }
     {
       # hive-priv creates the host socket dir `0751 root` and never chowns it,