diff --git a/install-stack.sh b/install-stack.sh
index 426d1bb..d788e2d 100755
--- a/install-stack.sh
+++ b/install-stack.sh
@@ -1747,6 +1747,10 @@ deploy_mqtt_broker() {
 
   msg_info "Deploying Mosquitto"
   pct exec 104 -- mkdir -p /opt/mqtt-broker/config /opt/mqtt-broker/data /opt/mqtt-broker/log
+  # eclipse-mosquitto:2 runs as its own non-root 'mosquitto' user (uid/gid 1883)
+  # and — unlike older images — no longer auto-chowns bind-mounted volumes, so
+  # a host-created (root-owned) data/log dir leaves it unable to write either.
+  pct exec 104 -- chown -R 1883:1883 /opt/mqtt-broker/data /opt/mqtt-broker/log
 
   # Dynamic-security plugin, not static password/ACL files — lets per-consumer
   # clients be created/revoked live later (via mosquitto_ctrl or, eventually,