diff --git a/iso/builder/config/hooks/normal/9000-bee-setup.hook.chroot b/iso/builder/config/hooks/normal/9000-bee-setup.hook.chroot
index 7e2ba00..1ddaba1 100755
--- a/iso/builder/config/hooks/normal/9000-bee-setup.hook.chroot
+++ b/iso/builder/config/hooks/normal/9000-bee-setup.hook.chroot
@@ -46,6 +46,17 @@ if [ "$GPU_VENDOR" = "nvidia" ]; then
     systemctl enable nvidia-dcgm.service 2>/dev/null || true
     systemctl enable nvidia-fabricmanager.service 2>/dev/null || true
     systemctl enable bee-nvidia.service
+
+    # nvidia-dcgm.service runs `nv-hostengine --service-account nvidia-dcgm`,
+    # which drops privileges to that account for all file I/O and writes
+    # diagnostics to DCGM_HOME_DIR (/var/log/nvidia-dcgm, per the packaged
+    # unit's Environment=). The package postinst doesn't reliably create/own
+    # this directory inside a live-build chroot, so `dcgmi diag`'s deployment
+    # check fails with DCGM_FR_FILE_CREATE_PERMISSIONS at boot. Own it here
+    # to match nv-hostengine's actual runtime identity.
+    if id nvidia-dcgm >/dev/null 2>&1; then
+        install -d -o nvidia-dcgm -g nvidia-dcgm -m 0755 /var/log/nvidia-dcgm
+    fi
 elif [ "$GPU_VENDOR" = "amd" ]; then
     # ROCm symlinks (packages install to /opt/rocm-*/bin/)
     for tool in rocm-smi rocm-bandwidth-test rvs; do