diff --git a/docker/api.Dockerfile b/docker/api.Dockerfile
index 2acb772..f67b71d 100644
--- a/docker/api.Dockerfile
+++ b/docker/api.Dockerfile
@@ -30,6 +30,10 @@ COPY --from=builder /usr/local/bin /usr/local/bin
 COPY app ./app
 COPY migrations ./migrations
 COPY alembic.ini ./alembic.ini
+# Owned by aurora *before* the volume mount happens — see worker.Dockerfile
+# for why (a fresh named volume otherwise defaults to root-owned, which the
+# non-root `aurora` user below can't write into).
+RUN mkdir -p /app/media && chown -R aurora:aurora /app/media
 
 USER aurora
 
diff --git a/docker/worker.Dockerfile b/docker/worker.Dockerfile
index 92b1e84..cac5154 100644
--- a/docker/worker.Dockerfile
+++ b/docker/worker.Dockerfile
@@ -31,6 +31,12 @@ RUN useradd --create-home --uid 1000 aurora
 COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
 COPY --from=builder /usr/local/bin /usr/local/bin
 COPY app ./app
+# Owned by aurora *before* the volume mount happens: Docker populates a
+# fresh named volume (docker-compose.yml's aurora_media_data) from whatever
+# already exists at its mount point in the image, ownership included. Skip
+# this and a brand-new volume defaults to root-owned, which the non-root
+# `aurora` user below can't write into.
+RUN mkdir -p /app/media && chown -R aurora:aurora /app/media
 
 USER aurora