diff --git a/web/Dockerfile b/web/Dockerfile
index 6552cd1..7f5a89d 100644
--- a/web/Dockerfile
+++ b/web/Dockerfile
@@ -38,9 +38,12 @@ RUN adduser --system --uid 1001 nextjs
 
 COPY --from=builder /app/public ./public
 
-# Set the correct permission for prerender cache
-RUN mkdir .next
-RUN chown nextjs:nodejs .next
+# Set the correct permission for prerender cache.
+# .next/cache must exist in the image already owned by nextjs: if a volume is
+# mounted at .next/cache/<subdir>, Docker creates the missing parent as root,
+# and the runtime user then can't mkdir siblings like fetch-cache (EACCES).
+RUN mkdir -p .next/cache
+RUN chown -R nextjs:nodejs .next
 
 # Automatically leverage output traces to reduce image size
 # https://nextjs.org/docs/advanced-features/output-file-tracing