diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 7127349..2c8919f 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -60,6 +60,15 @@ services:
     #     open(). `180:*` covers lp0/lp1/lp2… so a USB replug/boot-order renumber still works
     #     (the printer's path can move; set Connection=USB + the matching /dev/usb/lpN in setup).
     # (Bind-mounting the dir, not a single `devices:` node, is what survives renumbering.)
+    #
+    # ...AND access: the lpN node is `crw-rw---- root:lp` (mode 660). The server runs as the
+    # non-root `app` user, which is NOT in `lp`, so open(O_WRONLY) → EACCES → still "offline".
+    # group_add the HOST's `lp` GID (numeric — `getent group lp`, typically 7 on Debian/Ubuntu)
+    # so the app process gains that supplementary group and can write the 660 node. Least-
+    # privilege (no world-writable device, no root, no rebuild). VERIFY the GID on the booth;
+    # if the host's lp GID differs, change the number here.
+    group_add:
+      - "7"
     volumes:
       - /dev/usb:/dev/usb
     device_cgroup_rules: