From 47251539625bab6815ef6fd525f0b5dd82b99007 Mon Sep 17 00:00:00 2001
From: xJayMorex <3513159+xJayMorex@users.noreply.github.com>
Date: Fri, 25 Sep 2026 11:49:17 +0200
Subject: [PATCH] fix: only chown /data/keys.json if necessary

---
 docker/rootfs/etc/s6-overlay/s6-rc.d/prepare/30-ownership.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/docker/rootfs/etc/s6-overlay/s6-rc.d/prepare/30-ownership.sh b/docker/rootfs/etc/s6-overlay/s6-rc.d/prepare/30-ownership.sh
index 4236c90a2..1306e7035 100755
--- a/docker/rootfs/etc/s6-overlay/s6-rc.d/prepare/30-ownership.sh
+++ b/docker/rootfs/etc/s6-overlay/s6-rc.d/prepare/30-ownership.sh
@@ -49,7 +49,9 @@ done
 # Ensure the JWT key file is owned by the runtime user, even when the /data
 # directory ownership already matches PUID:PGID (chownit skips recursion then)
 if [ -f /data/keys.json ]; then
-	chown "$PUID:$PGID" /data/keys.json
+	if [ "$(stat -c '%u:%g' '/data/keys.json')" != "$PUID:$PGID" ]; then
+		chown "$PUID:$PGID" /data/keys.json
+	fi
 fi
 
 if [ "$(is_true "${SKIP_CERTBOT_OWNERSHIP:-}")" = '1' ]; then