diff --git a/RUNBOOK.md b/RUNBOOK.md
index 76e1195..c080148 100644
--- a/RUNBOOK.md
+++ b/RUNBOOK.md
@@ -120,21 +120,10 @@ zfs create -o mountpoint=/opt/argento/docker/immich/library threeteras/immich
 
 zpool status  # verify pools are ONLINE
 
-# Per-user SMB share dirs need ownership + setgid (rsync in step 7c will
-# preserve these if a USB backup exists, but freshly-created datasets are
-# root-owned and need this fixup).
-for u in yireh isaac; do
-    chown "$u":sambagroup "/opt/argento/smb/$u"
-    chmod 2770 "/opt/argento/smb/$u"
-done
-
 # Shared music dir. Lives inside the media dataset (so it rides the media
 # snapshot policy) but is exported as its own writable [music] share.
-# No chmod: threeteras/media is acltype=nfsv4 aclmode=restricted, so chmod
-# fails with EPERM. aclinherit=passthrough already copies the parent's ACL
-# onto the new dir, which is what grants sambagroup write.
+# Ownership is set in step 7b — sambagroup doesn't exist yet.
 mkdir -p /opt/argento/smb/media/Music
-chown timothykim:sambagroup /opt/argento/smb/media/Music
 
 # SELinux contexts for samba — fresh ZFS datasets get unlabeled_t and samba
 # refuses to serve them. Persistent rules (semanage) survive full relabels;
@@ -153,6 +142,20 @@ so file ownership lands on the correct UIDs.
 
 ```bash
 /opt/argento/scripts/restore-users.sh
+
+# Share dirs are root-owned on freshly created datasets. These must run AFTER
+# restore-users.sh — the users and sambagroup don't exist before it. Skip if
+# the datasets were imported intact; step 7c's rsync preserves ownership.
+for u in yireh isaac; do
+    chown "$u":sambagroup "/opt/argento/smb/$u"
+    chmod 2770 "/opt/argento/smb/$u"
+done
+
+# No chmod on Music: threeteras/media is acltype=nfsv4 aclmode=restricted, so
+# chmod fails with EPERM. aclinherit=passthrough already copied the parent's
+# ACL onto the dir, which is what grants sambagroup write. The other datasets
+# are acltype=posix aclmode=discard, so chmod works normally there.
+chown timothykim:sambagroup /opt/argento/smb/media/Music
 ```
 
 This recreates timothykim, yireh, isaac, hannah, and the sambagroup group with
@@ -267,7 +270,7 @@ Deploy each app (nginx is already running and will return 502 until they start):
 
 ```bash
 # Add any new apps that have been added since this was written
-for app in nextcloud gitea jellyfin navidrome garage minecraft immich beszel-agent; do
+for app in nextcloud gitea jellyfin navidrome garage minecraft immich beszel-agent diun; do
     cd /opt/argento/docker/$app
     docker compose pull
     docker compose build