diff --git a/lib/provision.sh b/lib/provision.sh
index 9df888c..d1fb3a5 100644
--- a/lib/provision.sh
+++ b/lib/provision.sh
@@ -138,7 +138,12 @@ provision_install_app() {
     echo "[4/10] Installing kiosk app..."
     # *.mjs: pdf-render.mjs (pdf.js only ships as a JavaScript module).
     sudo cp "$KIOSK_APP_SRC"/*.js "$KIOSK_APP_SRC"/*.mjs "$KIOSK_APP_SRC"/*.html "$KIOSK_APP_SRC/package.json" "$KIOSK_APP_SRC/start.sh" "$KIOSK_DIR/"
-    sudo chown "$KIOSK_USER:$KIOSK_USER" "$KIOSK_DIR"/*.js "$KIOSK_DIR"/*.mjs "$KIOSK_DIR"/*.html "$KIOSK_DIR/package.json" "$KIOSK_DIR/start.sh"
+    # Not `chown "$KIOSK_DIR"/*.js ...`: that glob is expanded by *this*
+    # (admin) shell before sudo runs, and the kiosk user's home is private
+    # (mode 750 on 26.04), so it can't be listed - the pattern stays literal
+    # and chown fails. find runs as root. Top level only: node_modules is
+    # already the kiosk user's, and chrome-sandbox inside it must stay root's.
+    sudo find "$KIOSK_DIR" -maxdepth 1 -type f -exec chown "$KIOSK_USER:$KIOSK_USER" {} +
     sudo chmod +x "$KIOSK_DIR/start.sh"
 
     if offline_mode_active; then
diff --git a/menus/addon_asterisk_intercom.sh b/menus/addon_asterisk_intercom.sh
index c70a418..ff88e6b 100644
--- a/menus/addon_asterisk_intercom.sh
+++ b/menus/addon_asterisk_intercom.sh
@@ -62,7 +62,9 @@ baresip_installed_version() {
 # `apt install baresip` with no configured extension isn't something
 # this menu should call done.
 baresip_is_installed() {
-    command -v baresip &>/dev/null && [[ -f "$BARESIP_CONFIG_DIR/accounts" ]]
+    # sudo: it's under the kiosk user's home, which the admin running this
+    # can't look inside (mode 750) - a plain [[ -f ]] is always false there.
+    command -v baresip &>/dev/null && sudo test -f "$BARESIP_CONFIG_DIR/accounts"
 }
 
 baresip_is_running() {
@@ -78,9 +80,9 @@ addon_asterisk_intercom_status() {
         else
             echo "Asterisk Intercom: Installed (v${ver:-unknown}) - Not running"
         fi
-        if [[ -f "$BARESIP_CONFIG_DIR/accounts" ]]; then
+        if sudo test -f "$BARESIP_CONFIG_DIR/accounts"; then
             local account
-            account=$(head -1 "$BARESIP_CONFIG_DIR/accounts" 2>/dev/null)
+            account=$(sudo head -1 "$BARESIP_CONFIG_DIR/accounts" 2>/dev/null)
             local extension="${account#<sip:}"
             extension="${extension%%@*}"
             [[ -n "$extension" ]] && echo "  Extension: $extension"