diff --git a/deploy/render-secrets.sh b/deploy/render-secrets.sh
index 43f0cc9..b44a965 100755
--- a/deploy/render-secrets.sh
+++ b/deploy/render-secrets.sh
@@ -62,11 +62,15 @@ render_thermograph_secrets() {
   # writable by us (e.g. a group-writable 0660 root:<deploygroup> on a box whose CI
   # deploy user isn't root and has no broad sudo — beta's `deploy`), since that needs
   # only file write, not /etc dir write or sudo. Else install; else sudo install (a
-  # root/agent deploy). Fail loudly rather than deploy against stale secrets.
+  # root/agent deploy) -- and on that sudo path CHOWN the result to the invoking
+  # deploy user (-o/-g $(id -un/-gn)), or the file lands root:root 0640 and the very
+  # next line of deploy.sh (`. /etc/thermograph.env` as that non-root user) can't read
+  # it, so POSTGRES_PASSWORD never enters the env and `docker compose` dies on
+  # interpolation. Fail loudly rather than deploy against stale secrets.
   if [ -f /etc/thermograph.env ] && [ -w /etc/thermograph.env ]; then
     cat "$tmp" > /etc/thermograph.env
   elif install -m 0640 "$tmp" /etc/thermograph.env 2>/dev/null; then :
-  elif sudo install -m 0640 "$tmp" /etc/thermograph.env 2>/dev/null; then :
+  elif sudo install -m 0640 -o "$(id -un)" -g "$(id -gn)" "$tmp" /etc/thermograph.env 2>/dev/null; then :
   else
     rm -f "$tmp"
     echo "!! cannot write /etc/thermograph.env (need file write access or passwordless sudo)" >&2