diff --git a/compose.yaml b/compose.yaml
index 15f3ec3..1e5998d 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -321,6 +321,10 @@ services:
     networks: [frontend, control, inference]
     security_opt: ["no-new-privileges:true"]
     cap_drop: [ALL]
+    # The entrypoint fixes ownership of fresh named volumes and immediately
+    # drops to uid/gid 10002 via gosu before starting the router. Without this
+    # narrowly scoped capability a clean installation loops before startup.
+    cap_add: [CHOWN]
     depends_on:
       profile-controller:
         condition: service_healthy