diff --git a/iso/builder/config/hooks/normal/9000-bee-setup.hook.chroot b/iso/builder/config/hooks/normal/9000-bee-setup.hook.chroot
index 1ddaba1..a245eac 100755
--- a/iso/builder/config/hooks/normal/9000-bee-setup.hook.chroot
+++ b/iso/builder/config/hooks/normal/9000-bee-setup.hook.chroot
@@ -50,12 +50,20 @@ if [ "$GPU_VENDOR" = "nvidia" ]; then
     # nvidia-dcgm.service runs `nv-hostengine --service-account nvidia-dcgm`,
     # which drops privileges to that account for all file I/O and writes
     # diagnostics to DCGM_HOME_DIR (/var/log/nvidia-dcgm, per the packaged
-    # unit's Environment=). The package postinst doesn't reliably create/own
-    # this directory inside a live-build chroot, so `dcgmi diag`'s deployment
-    # check fails with DCGM_FR_FILE_CREATE_PERMISSIONS at boot. Own it here
-    # to match nv-hostengine's actual runtime identity.
+    # unit's Environment=). The package's own postinst already creates and
+    # chowns this directory correctly — but it's empty at that point, and
+    # lib/squashfs-layers.sh's classifier only tracks regular files and
+    # symlinks (`find ... -type f -o -type l`), so an empty directory is
+    # silently dropped from every layer's rsync --files-from list and never
+    # reaches the built ISO at all. `dcgmi diag`'s deployment check then
+    # fails with DCGM_FR_FILE_CREATE_PERMISSIONS at boot because the
+    # directory doesn't exist, regardless of ownership. Re-create it and
+    # seed one real file so it rides along the classifier and rsync -a
+    # recreates the parent directory (with this ownership) as an implied
+    # parent.
     if id nvidia-dcgm >/dev/null 2>&1; then
         install -d -o nvidia-dcgm -g nvidia-dcgm -m 0755 /var/log/nvidia-dcgm
+        install -o nvidia-dcgm -g nvidia-dcgm -m 0644 /dev/null /var/log/nvidia-dcgm/.keep
     fi
 elif [ "$GPU_VENDOR" = "amd" ]; then
     # ROCm symlinks (packages install to /opt/rocm-*/bin/)
diff --git a/iso/builder/config/hooks/normal/9999-slim.hook.chroot b/iso/builder/config/hooks/normal/9999-slim.hook.chroot
index f9bea21..25642d3 100755
--- a/iso/builder/config/hooks/normal/9999-slim.hook.chroot
+++ b/iso/builder/config/hooks/normal/9999-slim.hook.chroot
@@ -27,6 +27,9 @@ rm -rf /var/lib/apt/lists/*
 
 # ── Misc ──────────────────────────────────────────────────────────────────────
 rm -rf /tmp/* /var/tmp/* 2>/dev/null || true
-find /var/log -type f -delete 2>/dev/null || true
+# /var/log/nvidia-dcgm/.keep is intentionally seeded by 9000-bee-setup so an
+# otherwise-empty DCGM_HOME_DIR survives the squashfs layer classifier (which
+# only tracks files/symlinks, not empty directories) — never sweep it up here.
+find /var/log -type f ! -path '/var/log/nvidia-dcgm/.keep' -delete 2>/dev/null || true
 
 echo "=== slim: done ==="