diff --git a/hermes_cli/main.py b/hermes_cli/main.py
index 7229bea467..bf83065f91 100644
--- a/hermes_cli/main.py
+++ b/hermes_cli/main.py
@@ -612,7 +612,7 @@ def _exec_in_container(container_info: dict, cli_args: list):
         if val:
             env_flags.extend(["-e", f"{var}={val}"])
 
-    cmd_prefix = [shutil.which("sudo"), "-n", runtime] if needs_sudo else [runtime]
+    cmd_prefix = [sudo, "-n", runtime] if needs_sudo else [runtime]
     exec_cmd = (
         cmd_prefix + ["exec"]
         + tty_flags
diff --git a/nix/nixosModules.nix b/nix/nixosModules.nix
index 8bc592fafe..918c52c149 100644
--- a/nix/nixosModules.nix
+++ b/nix/nixosModules.nix
@@ -684,6 +684,7 @@ HERMES_CONTAINER_MODE_EOF
                   current_target=$(readlink "${symlinkPath}")
                   if [ "$current_target" != "${target}" ]; then
                     ln -sfn "${target}" "${symlinkPath}"
+                    chown -h ${user}:${cfg.group} "${symlinkPath}"
                   fi
                 elif [ -d "${symlinkPath}" ]; then
                   # Existing real directory — backup and replace