diff --git a/apps/api/tests/test_signal_worker_ansible_executor_binding.py b/apps/api/tests/test_signal_worker_ansible_executor_binding.py
index f08234b9c..1a18c20d0 100644
--- a/apps/api/tests/test_signal_worker_ansible_executor_binding.py
+++ b/apps/api/tests/test_signal_worker_ansible_executor_binding.py
@@ -22,6 +22,7 @@ def test_worker_manifest_mounts_existing_ssh_mcp_transport() -> None:
 
     assert 'command: ["python", "-m", "src.workers.signal_worker"]' in manifest
     assert "serviceAccountName: awoooi-executor" in manifest
+    assert "fsGroup: 1000" in manifest
     assert "ENABLE_AWOOOP_ANSIBLE_CHECK_MODE_WORKER" in manifest
     assert "ENABLE_AWOOOP_ANSIBLE_CONTROLLED_APPLY" in manifest
     assert "AWOOOP_ANSIBLE_CHECK_MODE_STARTUP_SLEEP_SECONDS" in manifest
diff --git a/k8s/awoooi-prod/08-deployment-worker.yaml b/k8s/awoooi-prod/08-deployment-worker.yaml
index a02463f01..ab14b6acc 100644
--- a/k8s/awoooi-prod/08-deployment-worker.yaml
+++ b/k8s/awoooi-prod/08-deployment-worker.yaml
@@ -44,6 +44,8 @@ spec:
         environment: prod
         component: signal-processor
     spec:
+      securityContext:
+        fsGroup: 1000
       # 2026-07-01 Codex: keep hostname spread as a preference, not a hard
       # scheduler blocker, so reboot recovery and GitOps rollouts do not deadlock.
       topologySpreadConstraints: