diff --git a/bootstrap-install.sh b/bootstrap-install.sh
index ca751bf..077d8e6 100644
--- a/bootstrap-install.sh
+++ b/bootstrap-install.sh
@@ -3,11 +3,8 @@
 #
 # Skapar INTE ny Node-RED-container. Patchar /home/ncdeploy/nextcloud-node-red och bygger om.
 #
-# One-liner:
-#   curl -fsSL https://git.domain.name/your-user/nextcloud-collabora-nodered/raw/branch/main/bootstrap-install.sh | bash
-#
-# Som ncdeploy (rekommenderat):
-#   curl -fsSL ... | sudo -u ncdeploy bash
+# One-liner (kör som ncdeploy, INTE root):
+#   curl -fsSL https://git.domain.name/your-user/nextcloud-collabora-nodered/raw/branch/main/bootstrap-install.sh | sudo -u ncdeploy bash
 #
 # Om git "dubious ownership" (root ägde repot):
 #   sudo bash scripts/fix-repo-ownership.sh
@@ -64,7 +61,7 @@ reexec_as_install_user() {
         log "Kör om som ${user} (inte root)..."
         export BOOTSTRAP_REEXEC=1
         export INSTALL_DIR NODERED_DIR INSTALL_MODE GIT_REPO_URL GIT_BRANCH
-        exec run_as_root sudo -u "${user}" -H env \
+        exec sudo -u "${user}" -H env \
             BOOTSTRAP_REEXEC=1 \
             INSTALL_DIR="${INSTALL_DIR}" \
             NODERED_DIR="${NODERED_DIR}" \
diff --git a/scripts/integrate-into-nodered.sh b/scripts/integrate-into-nodered.sh
index 6a32548..2c7aa04 100644
--- a/scripts/integrate-into-nodered.sh
+++ b/scripts/integrate-into-nodered.sh
@@ -16,6 +16,68 @@ log() { printf '[integrate] %s\n' "$*"; }
 warn() { printf '[integrate] VARNING: %s\n' "$*" >&2; }
 die() { printf '[integrate] FEL: %s\n' "$*" >&2; exit 1; }
 
+run_as_root() {
+    if [ "$(id -u)" -eq 0 ]; then
+        "$@"
+    elif command -v sudo >/dev/null 2>&1; then
+        sudo "$@"
+    else
+        die "sudo/root krävs för: $*"
+    fi
+}
+
+runtime_user() {
+    if [ -n "${INSTALL_USER:-}" ]; then
+        echo "${INSTALL_USER}"
+    elif id ncdeploy >/dev/null 2>&1; then
+        echo "ncdeploy"
+    else
+        id -un
+    fi
+}
+
+# Docker build context måste kunna läsa nodes/ (inkl. odds-scraper — rör inte innehållet)
+fix_nodered_build_permissions() {
+    local user group
+    user="$(runtime_user)"
+    group="$(id -gn "${user}" 2>/dev/null || echo "${user}")"
+    if [ ! -d "${NODERED_DIR}/nodes" ]; then
+        return 0
+    fi
+    if run_as_root test -r "${NODERED_DIR}/nodes/odds-scraper" 2>/dev/null; then
+        : # root kan läsa
+    else
+        warn "nodes/odds-scraper oläsbar — fixar läsrättigheter för build (innehåll orört)"
+    fi
+    log "Säkerställer läsbar Docker build context under ${NODERED_DIR}/nodes"
+    run_as_root find "${NODERED_DIR}/nodes" -type d -exec chmod a+rx {} + 2>/dev/null || true
+    run_as_root find "${NODERED_DIR}/nodes" -type f -exec chmod a+r {} + 2>/dev/null || true
+    # Alternativt: ge ncdeploy ägarskap om katalogen ägs av root
+    if [ "$(stat -c '%U' "${NODERED_DIR}" 2>/dev/null)" = "root" ]; then
+        run_as_root chown -R "${user}:${group}" "${NODERED_DIR}"
+    fi
+}
+
+compose_cmd() {
+    if docker compose version >/dev/null 2>&1; then
+        echo "docker compose"
+    else
+        echo "docker-compose"
+    fi
+}
+
+# sudo docker compose: root läser hela build context (fixar permission denied på odds-scraper)
+compose_run() {
+    local compose
+    compose="$(compose_cmd)"
+    cd "${NODERED_DIR}"
+    if [ "$(id -u)" -eq 0 ]; then
+        ${compose} "$@"
+    else
+        run_as_root ${compose} "$@"
+    fi
+}
+
 resolve_paths() {
     if [ "$(id -u)" -eq 0 ] && [ -d "/home/ncdeploy/nextcloud-node-red" ]; then
         NODERED_DIR="${NODERED_DIR:-/home/ncdeploy/nextcloud-node-red}"
@@ -106,18 +168,14 @@ connect_code_network() {
 }
 
 rebuild_nodered() {
-    local compose="docker compose"
-    if ! docker compose version >/dev/null 2>&1; then
-        compose="docker-compose"
-    fi
     log "Bygger om ${NODERED_CONTAINER} (samma instans, port ${NODERED_PORT})..."
-    cd "${NODERED_DIR}"
+    fix_nodered_build_permissions
     if [ "${FORCE_REBUILD:-0}" = "1" ]; then
-        ${compose} build --no-cache
+        compose_run build --no-cache
     else
-        ${compose} build
+        compose_run build
     fi
-    ${compose} up -d
+    compose_run up -d
 }
 
 wait_nodered() {