diff --git a/.env b/.env
index 770e8ec..f18a25a 100644
--- a/.env
+++ b/.env
@@ -268,13 +268,14 @@ RTE_TOKEN=AnsibleForms!RTE!Token!123
 # Default: git push
 # GIT_PUSH_COMMAND=git push
 
-# Home directory inside the container. Used by docker-compose.yml to mount data/ssh and
-# data/git/.gitconfig there. Only change it together with HOME_PATH.
-HOME_DIR=/root
+# Home directory inside the containers, which run as the user node (uid 1000). Used by
+# docker-compose.yml to mount data/ssh and data/git/.gitconfig there. Only change it together
+# with HOME_PATH.
+HOME_DIR=/home/node
 
 # Home directory the app uses for its SSH key and git connections
-# Default: OS home directory (/root in the image)
-# HOME_PATH=/root
+# Default: OS home directory (/home/node in the image)
+# HOME_PATH=/home/node
 
 # =============================================================================
 # YTT (YAML TEMPLATING TOOL) CONFIGURATION
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ef15dda..23c7996 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,6 +26,10 @@ jobs:
       - name: The compose file is valid
         run: docker compose config --quiet
 
+      # the containers run as uid 1000, the checkout belongs to the runner's user (README.md)
+      - name: Give the containers the data folder
+        run: sudo chown -R 1000:1000 data
+
       - name: Start the stack
         run: docker compose up -d
 
diff --git a/README.md b/README.md
index 5292f55..c46f336 100644
--- a/README.md
+++ b/README.md
@@ -27,9 +27,13 @@ The app then listens on https://localhost with a self-signed certificate; log in
 ```bash
 git clone https://github.com/ansibleforms/docker.git ansibleforms
 cd ansibleforms
+sudo chown -R 1000:1000 data
 docker compose up -d
 ```
 
+The app and the RTE run as the user `node` (uid 1000), so they need to own `data/`: that is what the `chown` is for.
+Coming from 6, whose container ran as root, run the same `chown` once before you start 7; MySQL takes its own folder back when it starts.
+
 ## What you get
 
 Everything under `data/` is mounted into the containers and survives a restart or an upgrade.