diff --git a/hive-c0re/src/lifecycle.rs b/hive-c0re/src/lifecycle.rs
index dd635bf8..72821fca 100644
--- a/hive-c0re/src/lifecycle.rs
+++ b/hive-c0re/src/lifecycle.rs
@@ -781,11 +781,23 @@ pub fn ensure_claude_dir(claude_dir: &Path) -> Result<()> {
     // list the directory so `claude_has_session` can detect a valid session.
     // The credential files inside (`.credentials.json` etc.) are 0600 so the
     // secrets themselves stay private regardless of the directory mode.
+    //
+    // Best-effort: on the first container boot, `hive-agent-user-migrate`
+    // chowns this dir to the agent user. After that, hive-core (a different
+    // user) cannot chmod it — that's fine because the mode set during
+    // initial creation (0755) is preserved through the chown.
     #[cfg(unix)]
     {
         use std::os::unix::fs::PermissionsExt;
-        std::fs::set_permissions(claude_dir, std::fs::Permissions::from_mode(0o755))
-            .with_context(|| format!("chmod 755 {}", claude_dir.display()))?;
+        if let Err(e) =
+            std::fs::set_permissions(claude_dir, std::fs::Permissions::from_mode(0o755))
+        {
+            tracing::debug!(
+                path = %claude_dir.display(),
+                error = %e,
+                "ensure_claude_dir: chmod 755 skipped (dir likely owned by agent user after migration)"
+            );
+        }
     }
     Ok(())
 }