diff --git a/Dockerfile b/Dockerfile
index 567833f..95e46c4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -140,6 +140,8 @@ COPY --from=builder /app/scripts/safe-production-migrate.mjs ./scripts/safe-prod
 COPY --from=builder /app/scripts/create-verified-production-backup.mjs ./scripts/create-verified-production-backup.mjs
 COPY --from=builder /app/DEPLOYMENT_COMMIT /app/DEPLOYMENT_COMMIT
 RUN test "$(cat /app/DEPLOYMENT_COMMIT)" = "$VCS_REF" && \
+    test -x /app/node_modules/prisma/node_modules/@prisma/engines/schema-engine-linux-musl && \
+    chown -R node:node /app/node_modules/prisma/node_modules/@prisma/engines && \
     chmod -R a-w /app/prisma /app/scripts /app/DEPLOYMENT_COMMIT
 USER node
 ENTRYPOINT ["node", "scripts/safe-production-migrate.mjs"]
diff --git a/scripts/safe-production-migrate.test.mjs b/scripts/safe-production-migrate.test.mjs
index 2ed67f8..1e580ae 100644
--- a/scripts/safe-production-migrate.test.mjs
+++ b/scripts/safe-production-migrate.test.mjs
@@ -519,6 +519,8 @@ test('container supply chain and migrator image are immutable while SOP keeps co
   assert.match(migrator, /command -v pg_restore >\/dev\/null/)
   assert.match(migrator, /command -v psql >\/dev\/null/)
   assert.match(migrator, /COPY --from=builder \/app\/scripts\/create-verified-production-backup\.mjs/)
+  assert.match(migrator, /test -x \/app\/node_modules\/prisma\/node_modules\/@prisma\/engines\/schema-engine-linux-musl/)
+  assert.match(migrator, /chown -R node:node \/app\/node_modules\/prisma\/node_modules\/@prisma\/engines/)
   assert.match(sop, /tar -xOf "\$MIGRATOR_ARCHIVE" manifest\.json/)
   assert.match(sop, /entry\.RepoTags\.includes\(image\)/)
   assert.match(sop, /\^blobs\\\/sha256\\\/\(\[0-9a-f\]\{64\}\)\$/)