diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5a69db58..2fcdeccb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,11 @@
 
 All notable changes to this project will be documented in this file.
 
+## Unreleased
+### Fixed
+* fix(docker): create `apps-writable` as root so bind mounted apps can be used
+* fix(docker): list the apps only after `apps-writable` is a known apps path
+
 ## v0.5.0 - 2026-07-02
 ### Breaking changes
 `runExec` and `runOcc` now return an object instead of the plain output string.
diff --git a/lib/docker.ts b/lib/docker.ts
index 0a87953b..d704d17f 100644
--- a/lib/docker.ts
+++ b/lib/docker.ts
@@ -262,13 +262,11 @@ export async function configureNextcloud(apps = ['viewer'], vendoredBranch?: str
 	}
 	console.log('│  └─ OK !')
 
-	// Build app list
-	const { stdout: json } = await runOcc(['app:list', '--output', 'json'], { container })
-	const applist = JSON.parse(json)
-
 	console.log('├─ Using "apps-writable" folder for mounted apps')
-	await runExec(['mkdir', '-p', '/var/www/html/apps-writable'], { container })
-	await runExec(['chown', 'www-data:www-data', '/var/www/html/apps-writable'], { container })
+	// Bind mounting an app makes Docker pre-create the directory owned by root,
+	// so both commands have to run as root to be able to hand it over to `www-data`
+	await runExec(['mkdir', '-p', '/var/www/html/apps-writable'], { container, user: 'root' })
+	await runExec(['chown', 'www-data:www-data', '/var/www/html/apps-writable'], { container, user: 'root' })
 	const appsConfig = `<?php
 	$CONFIG = [
 		'apps_paths' => [
@@ -289,6 +287,10 @@ export async function configureNextcloud(apps = ['viewer'], vendoredBranch?: str
 	stream.finalize()
 	await container.putArchive(stream, { path: '/var/www/html/config' })
 
+	// Build app list, only now that "apps-writable" is a known apps path so that mounted apps show up
+	const { stdout: json } = await runOcc(['app:list', '--output', 'json'], { container })
+	const applist = JSON.parse(json)
+
 	// Enable apps and give status
 	for (const app of apps) {
 		if (app in applist.enabled) {