diff --git a/scripts/ha/deploy.sh b/scripts/ha/deploy.sh
index b47c079..618e5ef 100755
--- a/scripts/ha/deploy.sh
+++ b/scripts/ha/deploy.sh
@@ -243,11 +243,15 @@ if ! $SKIP_CREATE_VMS && ! $DRY_RUN; then
   # Fix /nix ownership if it exists but belongs to a different UID.
   # pve1's IPA-enrolled wayne (UID 50002) can't write to a store created by
   # another UID — passwordless sudo corrects it once.
-  if pve_check "test -d /nix" &>/dev/null && ! pve_check "test -w /nix" &>/dev/null; then
+  # Use direct SSH (no sudo) for the writability check so we test wayne's own
+  # access, not root's.
+  local_ssh() { ssh -i ~/.ssh/id_ed25519 "${SSH_USER}@${NODE}" "$*"; }
+  if local_ssh "test -d /nix" &>/dev/null && ! local_ssh "test -w /nix" &>/dev/null; then
     logn "/nix exists but not writable by ${SSH_USER} — fixing ownership with sudo (one-time)..."
-    ssh -i ~/.ssh/id_ed25519 "${SSH_USER}@${NODE}" "sudo chown -R ${SSH_USER} /nix"
+    local_ssh "sudo chown -R ${SSH_USER} /nix"
     logn "Done."
   fi
+  unset -f local_ssh
 
   # Ensure the remote clone is on the correct branch so create-proxmox-resource.sh
   # builds from the same commits we're deploying.