diff --git a/scripts/deploy_gitlab.sh b/scripts/deploy_gitlab.sh
index 90ee152..7776616 100755
--- a/scripts/deploy_gitlab.sh
+++ b/scripts/deploy_gitlab.sh
@@ -49,6 +49,46 @@ require_command docker
 require_command rsync
 require_command python3
 
+repair_deploy_permissions() {
+  if [[ ! -d "$DEPLOY_DIR" ]]; then
+    return
+  fi
+
+  local target_uid
+  local target_gid
+  target_uid="$(id -u)"
+  target_gid="$(id -g)"
+
+  docker run --rm \
+    -e TARGET_UID="$target_uid" \
+    -e TARGET_GID="$target_gid" \
+    -v "$DEPLOY_DIR:/deploy" \
+    alpine:3.21 \
+    sh -lc '
+      set -eu
+      prune_expr="
+        -path /deploy/.env.production -o
+        -path /deploy/.env.production.* -o
+        -path /deploy/.data -o -path /deploy/.data/* -o
+        -path /deploy/.data_local -o -path /deploy/.data_local/* -o
+        -path /deploy/.data_gate3 -o -path /deploy/.data_gate3/* -o
+        -path /deploy/.data_gate4 -o -path /deploy/.data_gate4/* -o
+        -path /deploy/.data_uat_dry_run -o -path /deploy/.data_uat_dry_run/* -o
+        -path /deploy/.data_uat_preflight -o -path /deploy/.data_uat_preflight/* -o
+        -path /deploy/.models -o -path /deploy/.models/* -o
+        -path /deploy/.asterisk_assets -o -path /deploy/.asterisk_assets/* -o
+        -path /deploy/.db_backups -o -path /deploy/.db_backups/* -o
+        -path /deploy/.deploy_backups -o -path /deploy/.deploy_backups/*
+      "
+      # shellcheck disable=SC2086
+      find /deploy \( $prune_expr \) -prune -o -exec chown "$TARGET_UID:$TARGET_GID" {} +
+      # shellcheck disable=SC2086
+      find /deploy \( $prune_expr \) -prune -o -type d -exec chmod u+rwx {} +
+      # shellcheck disable=SC2086
+      find /deploy \( $prune_expr \) -prune -o -type f -exec chmod u+rw {} +
+    '
+}
+
 if docker compose version >/dev/null 2>&1; then
   COMPOSE_CMD=(docker compose)
 elif command -v docker-compose >/dev/null 2>&1; then
@@ -69,6 +109,7 @@ if ! docker info >/dev/null 2>&1; then
 fi
 
 install -d "$DEPLOY_DIR"
+repair_deploy_permissions
 cd "$DEPLOY_DIR"
 
 if [[ "$CI_PROJECT_DIR" != "$DEPLOY_DIR" ]]; then