diff --git a/deploy/deploy-test-server.sh b/deploy/deploy-test-server.sh
index d51b749..f905aa9 100755
--- a/deploy/deploy-test-server.sh
+++ b/deploy/deploy-test-server.sh
@@ -177,13 +177,14 @@ run_as_left4me sh -c "cd /opt/left4me/l4d2web && set -a; . /etc/left4me/host.env
     PYTHONPATH=/opt/left4me \
     /opt/left4me/.venv/bin/alembic -c /opt/left4me/l4d2web/alembic.ini upgrade head"
 
-# Tighten the application database to root:left4me 0640. The DB is created
-# by the web app at first start with the default 0644 umask, which makes it
-# world-readable on the host. The script-overlay sandbox runs as a separate
-# system uid (l4d2-sandbox) — without this clamp, a sandboxed script could
-# read the entire app DB. Idempotent on rerun.
+# Tighten the application database to left4me:left4me 0640. The DB is
+# created by the web app at first start with the default 0644 umask, which
+# makes it world-readable on the host. The script-overlay sandbox runs as a
+# separate system uid (l4d2-sandbox) which is NOT in the left4me group —
+# 0640 blocks it via "other". The owner (left4me) keeps read+write so the
+# web service can update the DB. Idempotent on rerun.
 if [ -f /var/lib/left4me/left4me.db ]; then
-    $sudo_cmd chown root:left4me /var/lib/left4me/left4me.db
+    $sudo_cmd chown left4me:left4me /var/lib/left4me/left4me.db
     $sudo_cmd chmod 0640 /var/lib/left4me/left4me.db
 fi
 
diff --git a/deploy/tests/test_deploy_artifacts.py b/deploy/tests/test_deploy_artifacts.py
index 502fa98..dbcacf9 100644
--- a/deploy/tests/test_deploy_artifacts.py
+++ b/deploy/tests/test_deploy_artifacts.py
@@ -308,7 +308,9 @@ def test_deploy_script_does_not_install_bubblewrap():
 
 def test_deploy_script_tightens_left4me_db_permissions():
     script = DEPLOY_SCRIPT.read_text()
-    assert "chown root:left4me /var/lib/left4me/left4me.db" in script
+    # Owner left4me (the web service runs as this user and writes the DB);
+    # group left4me; mode 0640 — `other` (incl. l4d2-sandbox) gets nothing.
+    assert "chown left4me:left4me /var/lib/left4me/left4me.db" in script
     assert "chmod 0640 /var/lib/left4me/left4me.db" in script