diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix
index b1ad1dd..11731be 100644
--- a/nix/templates/harness-base.nix
+++ b/nix/templates/harness-base.nix
@@ -390,10 +390,13 @@
                   echo "tea-login: could not resolve username from forge API; skipping"
                   exit 0
                 fi
-                # tea reads config from $HOME/.config/tea/config.yml.
+                # tea reads config from ~/.config/tea/config.yml (for root: /root/.config/tea/config.yml).
                 # Write it directly so we control default:true and always
                 # refresh a rotated token — no 'tea login add' interactive dance.
-                CONFIG="$HOME/.config/tea/config.yml"
+                # Use getent to resolve root's home dir rather than $HOME which
+                # is unset in systemd service context (causing writes to /.config/).
+                _HOME=$(getent passwd root | cut -d: -f6)
+                CONFIG="$_HOME/.config/tea/config.yml"
                 mkdir -p "$(dirname "$CONFIG")" || true
                 cat > "$CONFIG" << EOF
         logins: