diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix
index c2d4acaa..d81178d5 100644
--- a/nix/templates/harness-base.nix
+++ b/nix/templates/harness-base.nix
@@ -705,14 +705,19 @@ in
       fi
       mkdir -p "$(dirname "$marker")"
       : > "$marker"
-      for stateDir in /agents/*/state; do
-        [ -d "$stateDir" ] || continue
-        chown -hR "$userName:$userName" "$stateDir" 2>/dev/null || true
-      done
-      for harnessDir in /agents/*/harness; do
-        [ -d "$harnessDir" ] || continue
-        chown -hR "$userName:$userName" "$harnessDir" 2>/dev/null || true
-      done
+      # Scope state + harness chowns to THIS container's own dirs only.
+      # The glob `/agents/*/state` also matches child-agent state dirs that
+      # are bind-mounted into parent containers, which would clobber the
+      # ownership those dirs' own activation scripts set — producing
+      # intermittent EACCES for the child agent's harness between a parent
+      # rebuild and the child's next activation. Config dirs are kept broad
+      # because the parent legitimately owns child proposed-config repos.
+      if [ -d "/agents/$userName/state" ]; then
+        chown -hR "$userName:$userName" "/agents/$userName/state" 2>/dev/null || true
+      fi
+      if [ -d "/agents/$userName/harness" ]; then
+        chown -hR "$userName:$userName" "/agents/$userName/harness" 2>/dev/null || true
+      fi
       # The proposed-config repo is RW-mounted into the editing (parent/
       # manager) agent and owned by it; hive-c0re only pulls from it. Heal
       # it to this user too — same as state/harness. In an agent's own