diff --git a/ubuntu-based-kiosk-v1.0.3.sh b/ubuntu-based-kiosk-v1.0.3.sh
index a825489..28849c3 100644
--- a/ubuntu-based-kiosk-v1.0.3.sh
+++ b/ubuntu-based-kiosk-v1.0.3.sh
@@ -11099,10 +11099,12 @@ install_electron_binary() {
             tmp_zip=$(mktemp --suffix=.zip)
             if wget --timeout=300 --tries=3 --show-progress -O "$tmp_zip" "$electron_url" 2>&1; then
                 command -v unzip >/dev/null 2>&1 || sudo apt install -y unzip
-                chmod 644 "$tmp_zip"   # mktemp creates root:root 600; kiosk user needs read access
-                sudo -u "$KIOSK_USER" mkdir -p "$KIOSK_DIR/node_modules/electron/dist"
-                sudo -u "$KIOSK_USER" unzip -o "$tmp_zip" -d "$KIOSK_DIR/node_modules/electron/dist/"
-                sudo -u "$KIOSK_USER" chmod +x "$electron_bin"
+                # Run as root so we can write regardless of who owns node_modules/electron/dist/
+                # (npm postinstall may create it as root when --unsafe-perm is used)
+                mkdir -p "$KIOSK_DIR/node_modules/electron/dist"
+                unzip -o "$tmp_zip" -d "$KIOSK_DIR/node_modules/electron/dist/"
+                chown -R "$KIOSK_USER:$KIOSK_USER" "$KIOSK_DIR/node_modules/electron/dist/"
+                chmod +x "$electron_bin"
             fi
             rm -f "$tmp_zip"
         fi
@@ -11305,7 +11307,8 @@ upgrade_kiosk() {
     fi
 
     # Verify and fix Electron binary + chrome-sandbox (same logic as fresh install)
-    install_electron_binary
+    # Use || return 1 to disable set -e inside the function (matches fresh install pattern)
+    install_electron_binary || { log_error "Electron setup failed — upgrade aborted."; return 1; }
 
     # Restore config
     if [[ -f "$config_backup" ]]; then