diff --git a/scripts/ha/deploy.sh b/scripts/ha/deploy.sh
index 0c9b78b..acdecac 100755
--- a/scripts/ha/deploy.sh
+++ b/scripts/ha/deploy.sh
@@ -236,6 +236,18 @@ if ! $SKIP_SYNC_KEYS; then
   done
 fi
 
+# ── Phase 2.5: Fix /nix ownership on Proxmox node if needed ──────────────────
+# pve1 has a pre-existing /nix store owned by a different UID (from a previous
+# installation); wayne has passwordless sudo so we fix it in-place before the
+# build so create-proxmox-resource.sh's codex-setup.sh can proceed.
+if ! $SKIP_CREATE_VMS && ! $DRY_RUN; then
+  if pve_check "test -d /nix" &>/dev/null && ! pve_check "test -w /nix" &>/dev/null; then
+    logn "/nix exists but not writable by ${SSH_USER} — fixing ownership with sudo (one-time)..."
+    ssh -i ~/.ssh/id_ed25519 "${SSH_USER}@${NODE}" "sudo chown -R ${SSH_USER} /nix"
+    logn "Done."
+  fi
+fi
+
 # ── Phase 3: Create VMs ───────────────────────────────────────────────────────
 
 if ! $SKIP_CREATE_VMS; then