diff --git a/server-tools/persona-team-handshake/deploy-on-demand-lifecycle.sh b/server-tools/persona-team-handshake/deploy-on-demand-lifecycle.sh
index 16502a3..7968f1c 100755
--- a/server-tools/persona-team-handshake/deploy-on-demand-lifecycle.sh
+++ b/server-tools/persona-team-handshake/deploy-on-demand-lifecycle.sh
@@ -68,8 +68,8 @@ test ! -e "${receipt}"
 /guanghu/bin/ghctl authorize /guanghu/current install_world_version |
   grep -q '^GUANGHU_ACTION_AUTHORIZED$'
 
-install -d -o root -g root -m 0700 \
-  "${receipt_root}" "${backup_root}"
+install -d -o guanghu -g guanghu -m 0750 "${receipt_root}"
+install -d -o root -g root -m 0700 "${backup_root}"
 for unit in "${units[@]}"; do
   if test -f "/etc/systemd/system/${unit}"; then
     cp "/etc/systemd/system/${unit}" "${temporary}/${unit}"
diff --git a/server-tools/persona-team-handshake/fifth-domain-daily-orchestrator.test.mjs b/server-tools/persona-team-handshake/fifth-domain-daily-orchestrator.test.mjs
index 56a1c4e..21a55d4 100644
--- a/server-tools/persona-team-handshake/fifth-domain-daily-orchestrator.test.mjs
+++ b/server-tools/persona-team-handshake/fifth-domain-daily-orchestrator.test.mjs
@@ -250,6 +250,10 @@ test("daily dispatcher unit is hardened and restricted to exact persona reposito
     /ghctl authorize \/guanghu\/current install_world_version/u,
   );
   assert.match(deployScript, /systemctl disable "\$\{handshakes\[@\]\}"/u);
+  assert.match(
+    deployScript,
+    /install -d -o guanghu -g guanghu -m 0750 "\$\{receipt_root\}"/u,
+  );
   assert.match(
     deployScript,
     /systemctl start zhuyuan-persona-fifth-domain-daily\.service/u,