diff --git a/deploy/compose.remote.yaml b/deploy/compose.remote.yaml
index 5c795342..2d0147e5 100644
--- a/deploy/compose.remote.yaml
+++ b/deploy/compose.remote.yaml
@@ -7,10 +7,19 @@
 x-drukbox: &drukbox
   image: ${DRUKS_SANDBOX_SERVICE_IMAGE:-ghcr.io/czpython/drukbox:latest}
   network_mode: host
+  # Cloud VMs are the sandbox home; the mounted socket serves the docker
+  # provider that browser-session containers run on. install.sh records the
+  # socket's gid so drukbox's non-root appuser may use it.
+  group_add:
+    - "${DRUKS_DOCKER_GID:-0}"
+  volumes:
+    - /var/run/docker.sock:/var/run/docker.sock
   env_file:
     - ./.env
   environment:
     DATABASE_URL: postgresql+psycopg://${DRUKS_POSTGRES_USER:-druks}:${DRUKS_POSTGRES_PASSWORD}@127.0.0.1:5432/drukbox
+    # Browser containers run sshd for the druks user, not root.
+    DOCKER_SSH_USERNAME: druks
   depends_on:
     postgres:
       condition: service_healthy
diff --git a/scripts/install.sh b/scripts/install.sh
index ff5fa7ff..40335830 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -124,17 +124,19 @@ main() {
 
   # COMPOSE_FILE → .env, so plain `docker compose` in this dir loads the right
   # overlay. `local` drives sandboxes on the host Docker daemon (dashboard on
-  # :8001, no Caddy); `remote` runs the cloud provider + Caddy. For local, the
-  # socket's gid rides along so drukbox's non-root appuser may use it — on
-  # macOS the host path is a user-owned symlink, but the socket Docker Desktop
-  # mounts into containers is group root, so the host gid would grant nothing.
+  # :8001, no Caddy); `remote` runs the cloud provider + Caddy. Both shapes
+  # mount the Docker socket — sandboxes on local, browser-session containers
+  # on remote — so the socket's gid rides along and drukbox's non-root appuser
+  # may use it. On macOS the host path is a user-owned symlink, but the socket
+  # Docker Desktop mounts into containers is group root, so the host gid would
+  # grant nothing.
+  if [ "$(uname -s)" = "Darwin" ]; then
+    set_env_var DRUKS_DOCKER_GID "0"
+  else
+    set_env_var DRUKS_DOCKER_GID "$(stat -c '%g' /var/run/docker.sock)"
+  fi
   if [ "$PROVIDER" = "docker" ]; then
     set_env_var COMPOSE_FILE "compose.yaml:compose.local.yaml"
-    if [ "$(uname -s)" = "Darwin" ]; then
-      set_env_var DRUKS_DOCKER_GID "0"
-    else
-      set_env_var DRUKS_DOCKER_GID "$(stat -c '%g' /var/run/docker.sock)"
-    fi
   else
     set_env_var COMPOSE_FILE "compose.yaml:compose.remote.yaml"
   fi