diff --git a/.github/actions/verify-container/action.yml b/.github/actions/verify-container/action.yml
index 068ff175e..05cf37d5b 100644
--- a/.github/actions/verify-container/action.yml
+++ b/.github/actions/verify-container/action.yml
@@ -154,6 +154,21 @@ runs:
         "${compose[@]}" exec -T codex-proxy-rs sh -c \
           'touch /app/.runtime/data/.ci-write /app/.runtime/logs/.ci-write && rm /app/.runtime/data/.ci-write /app/.runtime/logs/.ci-write'
 
+    - name: Verify application restart after installer permissions
+      shell: bash
+      run: |
+        set -euo pipefail
+        compose=(docker compose --project-name "$COMPOSE_PROJECT_NAME" \
+          -f deploy/compose.yaml)
+        "${compose[@]}" stop --timeout 30 codex-proxy-rs
+        # 使用安装器原函数，验证已有备份暂存目录与日志不会因所有权变更而阻止启动
+        (
+          export INSTALL_DIR="$PWD"
+          source deploy/install.sh
+          fix_runtime_permissions
+        )
+        "${compose[@]}" up -d --no-build --wait codex-proxy-rs
+
     - name: Verify clean logs and graceful shutdown
       shell: bash
       run: |
diff --git a/deploy/install.sh b/deploy/install.sh
index e62b5419a..30ee3b902 100755
--- a/deploy/install.sh
+++ b/deploy/install.sh
@@ -226,8 +226,8 @@ fix_runtime_permissions() {
   run_root chown -R "$redis_ids" -- "${RUNTIME_DIR}/redis"
   run_root chmod 0750 -- "${RUNTIME_DIR}/redis"
 
-  # 保留安装用户对应用目录的所有权，并向容器实际运行组授予读写权限。
-  run_root chown -R "$(id -u):${app_gid}" -- "${RUNTIME_DIR}/data" "${RUNTIME_DIR}/logs"
+  # 只设置顶层目录，保留应用创建的私有目录与文件的所有权，确保重复安装后仍可读写
+  run_root chown "$(id -u):${app_gid}" -- "${RUNTIME_DIR}/data" "${RUNTIME_DIR}/logs"
   run_root chmod 0770 -- "${RUNTIME_DIR}/data" "${RUNTIME_DIR}/logs"
   run_root chown "$(id -u):${app_gid}" -- "$CONFIG_FILE"
   run_root chmod 0640 -- "$CONFIG_FILE"