diff --git a/maintenance/bootstrap-v2.sh b/maintenance/bootstrap-v2.sh
index 9f9ffce..476bb7c 100755
--- a/maintenance/bootstrap-v2.sh
+++ b/maintenance/bootstrap-v2.sh
@@ -38,6 +38,16 @@ require_file() {
   [ -f "$path" ] || fail "Required file missing: $path"
 }
 
+run_privileged() {
+  if [ "$(id -u)" -eq 0 ]; then
+    "$@"
+  elif command -v sudo >/dev/null 2>&1; then
+    sudo "$@"
+  else
+    fail "Need root privileges for: $*"
+  fi
+}
+
 check_mode() {
   case "$MODE" in
     check|repair|deploy)
@@ -108,8 +118,30 @@ check_directories() {
 
 repair_ownership() {
   log "Repairing ownership"
-  chown -R "$APPFACTORY_UID:$APPFACTORY_GID" "$APPFACTORY_ROOT"
-  ok "Ownership repaired"
+
+  if run_privileged chown -R "$APPFACTORY_UID:$APPFACTORY_GID" "$APPFACTORY_ROOT"; then
+    ok "Ownership repaired"
+  else
+    warn "Ownership repair reported errors. This can happen for files owned/locked by running containers."
+
+    run_privileged chown -R "$APPFACTORY_UID:$APPFACTORY_GID" \
+      "$APPFACTORY_ROOT/apps" \
+      "$APPFACTORY_ROOT/backups" \
+      "$APPFACTORY_ROOT/config" \
+      "$APPFACTORY_ROOT/deploy" \
+      "$APPFACTORY_ROOT/gateway" \
+      "$APPFACTORY_ROOT/services" \
+      "$APPFACTORY_ROOT/templates" \
+      "$APPFACTORY_ROOT/tools" \
+      "$APPFACTORY_ROOT/workspace" \
+      "$APPFACTORY_ROOT/data/appfactory" \
+      "$APPFACTORY_ROOT/data/registry" \
+      "$APPFACTORY_ROOT/data/caddy" \
+      "$APPFACTORY_ROOT/data/caddy-config" \
+      2>/tmp/appfactory-bootstrap-chown.log || true
+
+    ok "Ownership repair completed with tolerated warnings"
+  fi
 }
 
 check_ownership() {