diff --git a/configs/nixos/AGENTS.md b/configs/nixos/AGENTS.md
index 787d496..a1e2c3d 100644
--- a/configs/nixos/AGENTS.md
+++ b/configs/nixos/AGENTS.md
@@ -44,3 +44,5 @@
 - `sops.secrets.<name>.owner` must name a user known on the decrypting host.
   Do not set the owner to a guest-only service user unless the host also declares that user.
   Use a host-visible owner plus a shared group mode when the guest service can read the decrypted secret file through its group.
+- Pikachu deploys from the monorepo checkout copied to `~/dev`.
+  Do not use the old `~/wrk/dotfiles` path for remote rebuild commands.
diff --git a/configs/nixos/guests/copyparty.nix b/configs/nixos/guests/copyparty.nix
index 4b79572..ac5dffb 100644
--- a/configs/nixos/guests/copyparty.nix
+++ b/configs/nixos/guests/copyparty.nix
@@ -111,7 +111,14 @@ in
             readOnly = true;
           };
         }
-        // lib.mapAttrs' (_urlPath: volume: lib.nameValuePair volume.path { directory = volume.hostPath; }) cfg.volumes;
+        // lib.mapAttrs' (_urlPath: volume:
+          lib.nameValuePair volume.path {
+            directory = volume.hostPath;
+            owner = "root";
+            group = "storage";
+            mode = "2770";
+          }
+        ) cfg.volumes;
       limits = {
         memory = lib.mkDefault "2G";
         cpu = lib.mkDefault "200%";
diff --git a/configs/nixos/modules/services/copyparty.nix b/configs/nixos/modules/services/copyparty.nix
index 3ce41ff..fd04482 100644
--- a/configs/nixos/modules/services/copyparty.nix
+++ b/configs/nixos/modules/services/copyparty.nix
@@ -34,7 +34,13 @@ let
 
   renderAccess = permission: accounts: "    ${permission}: ${lib.concatStringsSep ", " accounts}";
 
-  renderFlags = flags: lib.concatMapStringsSep "\n" (flag: "    ${flag}") flags;
+  hasFlag = name: flags: lib.any (flag: lib.hasPrefix "${name}:" flag || lib.hasPrefix "${name}=" flag) flags;
+
+  defaultPermissionFlags = flags:
+    lib.optionals (!(hasFlag "chmod_d" flags)) [ "chmod_d: 2770" ]
+    ++ lib.optionals (!(hasFlag "chmod_f" flags)) [ "chmod_f: 660" ];
+
+  renderFlags = flags: lib.concatMapStringsSep "\n" (flag: "    ${flag}") (flags ++ defaultPermissionFlags flags);
 
   renderVolume = urlPath: volume: ''
     [${urlPath}]
diff --git a/configs/nixos/modules/shell/fish/default.nix b/configs/nixos/modules/shell/fish/default.nix
index d91b313..8a4916a 100644
--- a/configs/nixos/modules/shell/fish/default.nix
+++ b/configs/nixos/modules/shell/fish/default.nix
@@ -8,8 +8,8 @@
 let
   cfg = config.modules.shell.fish;
   user = config.user.name;
-  shortcuts = config.registry.shell-shortcut.${config.networking.hostName};
-  envVars = config.registry.env-var.${config.networking.hostName};
+  shortcuts = lib.attrByPath [ config.networking.hostName ] { } config.registry.shell-shortcut;
+  envVars = lib.attrByPath [ config.networking.hostName ] { } config.registry.env-var;
   commandsOf = shortcuts: lib.mapAttrs (_name: shortcut: shortcut.command) shortcuts;
   exportEnvVar = name: value: ''
     set -gx ${name} ${lib.escapeShellArg value}
diff --git a/configs/nixos/modules/shell/fish/functions/deploy-to.fish b/configs/nixos/modules/shell/fish/functions/deploy-to.fish
index 24853f7..e14ad65 100644
--- a/configs/nixos/modules/shell/fish/functions/deploy-to.fish
+++ b/configs/nixos/modules/shell/fish/functions/deploy-to.fish
@@ -48,6 +48,6 @@ end
 
 set escaped_branch (string escape -- $branch)
 set escaped_host (string escape -- $host)
-set remote_command "cd ~/wrk/dotfiles && git fetch origin && git switch -- $escaped_branch && git reset --hard origin/$escaped_branch && sudo nixos-rebuild switch --flake .#$escaped_host --print-build-logs"
+set remote_command "cd ~/dev && git fetch origin && git switch -- $escaped_branch && git reset --hard origin/$escaped_branch && sudo nixos-rebuild switch --flake .#$escaped_host --print-build-logs"
 
 ssh -t $host $remote_command