diff --git a/ansible/roles/stack/tasks/main.yml b/ansible/roles/stack/tasks/main.yml
index 5145dc3..bd02072 100644
--- a/ansible/roles/stack/tasks/main.yml
+++ b/ansible/roles/stack/tasks/main.yml
@@ -53,6 +53,13 @@
     dest: "{{ stack_root }}/"
     delete: false
     recursive: true
+    # Non-root rsync cannot chown/chgrp files Docker created as root
+    # (e.g. searxng). Content sync only; ownership fixed in next task.
+    archive: true
+    owner: false
+    group: false
+    perms: true
+    times: true
     rsync_opts:
       - "--exclude=.git"
       - "--exclude=config/"
@@ -62,6 +69,9 @@
       - "--exclude=.env"
       - "--exclude=wireguard/wg0.conf"
       - "--exclude=ansible/.vault_pass"
+      - "--no-owner"
+      - "--no-group"
+      - "--chmod=Du=rwx,Dgo=rx,Fu=rw,Fgo=r"
   when: deploy_stack_files | bool
   become: false
   tags: [stack, deploy]
@@ -74,6 +84,7 @@
     group: "{{ stack_group }}"
     recurse: true
   when: deploy_stack_files | bool
+  # become: true from play — can reset root-owned files from containers
   tags: [stack, deploy]
 
 - name: Deploy production .env for this host