diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix
index 6b9331f1..5d8c2825 100644
--- a/nix/templates/harness-base.nix
+++ b/nix/templates/harness-base.nix
@@ -687,6 +687,18 @@ in
         [ -d "$stateDir" ] || continue
         chown -hR "$userName:$userName" "$stateDir" 2>/dev/null || true
       done
+      # Same treatment for the per-agent runtime dir bind
+      # (`/run/hive` ← host `/run/hyperhive/{manager,agents/<n>}`,
+      # set by hive-c0re's `set_nspawn_flags`). Host creates it
+      # root:root 0755; post-#658 the harness service runs as the
+      # agent user and needs RW to drop `mcp.sock` and the
+      # claude-{mcp-config,settings,system-prompt} files there.
+      # Not recursive (-h still, no -R) — the dir itself is what
+      # the harness writes into; contents are owned by whoever
+      # created them at runtime.
+      if [ -d /run/hive ]; then
+        chown -h "$userName:$userName" /run/hive 2>/dev/null || true
+      fi
     '';
 
     # Auto-inject the matrix MCP entry when matrix is enabled (#548