diff --git a/dankclaw/compose.yaml b/dankclaw/compose.yaml
index 985671c..c9992d5 100644
--- a/dankclaw/compose.yaml
+++ b/dankclaw/compose.yaml
@@ -103,6 +103,9 @@ services:
     image: docker.io/prom/prometheus:latest
     container_name: prometheus
     restart: unless-stopped
+    # Rootless: container uid 1000 maps to the invoking user, so the
+    # container can write its /opt/prometheus/data bind mount.
+    user: "1000:1000"
     command:
       - --config.file=/etc/prometheus/prometheus.yml
       - --storage.tsdb.path=/prometheus
@@ -123,6 +126,9 @@ services:
     image: docker.io/grafana/grafana:latest
     container_name: grafana
     restart: unless-stopped
+    # Rootless: container uid 1000 maps to the invoking user, so the
+    # container can write its /opt/grafana/data bind mount.
+    user: "1000:1000"
     environment:
       GF_SERVER_ROOT_URL: "https://grafana.franksdank.cloud"
       GF_SECURITY_ADMIN_USER: "${GRAFANA_ADMIN_USER}"
@@ -144,6 +150,9 @@ services:
     image: docker.io/grafana/loki:latest
     container_name: loki
     restart: unless-stopped
+    # Rootless: container uid 1000 maps to the invoking user, so the
+    # container can write its /opt/loki/data bind mount.
+    user: "1000:1000"
     command: ["-config.file=/etc/loki/loki-config.yaml"]
     ports:
       - "3100:3100"
diff --git a/tests/caddyfile.bats b/tests/caddyfile.bats
index e6bc0ec..a9204fc 100644
--- a/tests/caddyfile.bats
+++ b/tests/caddyfile.bats
@@ -118,3 +118,18 @@ CADDYFILE="$REPO_ROOT/dankclaw/Caddyfile"
 @test "prometheus targets are host:port (no URL schemes)" {
     ! grep -nE '^\s*-\s*"?http' "$REPO_ROOT/shared/prometheus/prometheus.yml"
 }
+
+@test "observability containers run as the host user (rootless uid mapping)" {
+    # Rootless podman maps container uid 1000 to the invoking user, so
+    # 1000:1000 lets these containers write their /opt data dirs. Container
+    # root would map to a subuid that owns nothing under /opt.
+    local compose="$REPO_ROOT/dankclaw/compose.yaml"
+    local svc
+    for svc in prometheus loki grafana; do
+        local block
+        block=$(awk "/^  $svc:$/,/^  [a-z]/" "$compose" | grep -v "^  $svc:")
+        echo "$block" | grep -q 'user: "1000:1000"' || {
+            echo "service $svc does not run as user 1000:1000"; return 1;
+        }
+    done
+}