diff --git a/prefetch-models.sh b/prefetch-models.sh
index 2eb1faa..dc02fd3 100755
--- a/prefetch-models.sh
+++ b/prefetch-models.sh
@@ -26,12 +26,18 @@ if ! command -v python3 &>/dev/null; then
     exit 1
 fi
 
-if ! mkdir -p data/models data/hf_cache 2>/dev/null; then
-    echo "✗ Could not create ./data/models or ./data/hf_cache." >&2
-    echo "  If ./data/ was already created by Docker (root-owned), re-run with sudo:" >&2
-    echo "    sudo ./prefetch-models.sh $*" >&2
-    exit 1
-fi
+# mkdir -p succeeds silently on an already-existing directory even when we
+# can't write into it, so actually test writability rather than trusting that.
+for d in data/models data/hf_cache; do
+    mkdir -p "$d" 2>/dev/null
+    if ! { touch "$d/.write_test" 2>/dev/null && rm -f "$d/.write_test"; }; then
+        echo "✗ No write permission in ./$d" >&2
+        echo "  This usually means Docker created ./data as root on a previous run." >&2
+        echo "  Fix permanently (the container runs as root and will still work fine):" >&2
+        echo "    sudo chown -R \$(id -u):\$(id -g) ./data" >&2
+        exit 1
+    fi
+done
 
 PREFETCH_SDXL=0
 if [ "${1:-}" = "--sdxl" ]; then
@@ -57,7 +63,18 @@ echo "── HuggingFace Hub models (BEN2, BiRefNet-HR) ───────"
 
 if ! python3 -c "import huggingface_hub" &>/dev/null; then
     echo "Installing huggingface_hub (lightweight — no torch/GPU needed for this step)..."
-    python3 -m pip install --quiet --user "huggingface_hub>=0.23.0" || FAILED+=("huggingface_hub install")
+    PIP_ERR=$(python3 -m pip install --quiet --user "huggingface_hub>=0.23.0" 2>&1) || {
+        if echo "$PIP_ERR" | grep -q "externally-managed-environment"; then
+            # PEP 668 (Debian/Ubuntu 12+): --user already keeps this out of
+            # apt-managed system site-packages, so overriding here is safe.
+            echo "System Python is externally managed — retrying with --break-system-packages"
+            python3 -m pip install --quiet --user --break-system-packages "huggingface_hub>=0.23.0" \
+                || FAILED+=("huggingface_hub install")
+        else
+            echo "$PIP_ERR" >&2
+            FAILED+=("huggingface_hub install")
+        fi
+    }
 fi
 
 if python3 -c "import huggingface_hub" &>/dev/null; then