diff --git a/Cargo.lock b/Cargo.lock
index 74f09bb..0bbc258 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1642,7 +1642,7 @@ checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
 
 [[package]]
 name = "lesavka_client"
-version = "0.13.10"
+version = "0.13.11"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -1676,7 +1676,7 @@ dependencies = [
 
 [[package]]
 name = "lesavka_common"
-version = "0.13.10"
+version = "0.13.11"
 dependencies = [
  "anyhow",
  "base64",
@@ -1688,7 +1688,7 @@ dependencies = [
 
 [[package]]
 name = "lesavka_server"
-version = "0.13.10"
+version = "0.13.11"
 dependencies = [
  "anyhow",
  "base64",
diff --git a/client/Cargo.toml b/client/Cargo.toml
index 5cf0242..302e615 100644
--- a/client/Cargo.toml
+++ b/client/Cargo.toml
@@ -4,7 +4,7 @@ path                    = "src/main.rs"
 
 [package]
 name                    = "lesavka_client"
-version                 = "0.13.10"
+version                 = "0.13.11"
 edition                 = "2024"
 
 [dependencies]
diff --git a/common/Cargo.toml b/common/Cargo.toml
index 7ea98b6..48e26e5 100644
--- a/common/Cargo.toml
+++ b/common/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name                    = "lesavka_common"
-version                 = "0.13.10"
+version                 = "0.13.11"
 edition                 = "2024"
 build                   = "build.rs"
 
diff --git a/scripts/install/server.sh b/scripts/install/server.sh
index 6203022..904f9ca 100755
--- a/scripts/install/server.sh
+++ b/scripts/install/server.sh
@@ -302,6 +302,11 @@ echo "==> 1c. GPIO permissions for relay"
 echo 'z /dev/gpiochip* 0660 root gpio -' | sudo tee /etc/tmpfiles.d/gpiochip.conf >/dev/null
 sudo systemd-tmpfiles --create /etc/tmpfiles.d/gpiochip.conf || true
 
+echo "==> 1d. Audio permissions for diagnostics"
+if getent group audio >/dev/null 2>&1 && [ -n "${SUDO_USER:-}" ] && [ "${SUDO_USER}" != "root" ]; then
+  sudo usermod -aG audio "${SUDO_USER}" || true
+fi
+
 echo "==> 2a. Kernel-driver tweaks"
 cat <<'EOF' | sudo tee /etc/modprobe.d/gc311-stream.conf >/dev/null
 options uvcvideo quirks=0x200 timeout=10000
diff --git a/server/Cargo.toml b/server/Cargo.toml
index a43d64e..92db870 100644
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -10,7 +10,7 @@ bench                   = false
 
 [package]
 name                    = "lesavka_server"
-version                 = "0.13.10"
+version                 = "0.13.11"
 edition                 = "2024"
 autobins                = false
 
diff --git a/testing/tests/server_install_script_contract.rs b/testing/tests/server_install_script_contract.rs
index b114a29..07db8e8 100644
--- a/testing/tests/server_install_script_contract.rs
+++ b/testing/tests/server_install_script_contract.rs
@@ -43,3 +43,15 @@ fn server_install_keeps_uac_sanity_helper_available() {
         "install script should install the UAC sanity helper to a stable path"
     );
 }
+
+#[test]
+fn server_install_grants_operator_audio_group_access() {
+    assert!(
+        SERVER_INSTALL.contains("usermod -aG audio"),
+        "install script should grant the invoking operator access to ALSA devices"
+    );
+    assert!(
+        SERVER_INSTALL.contains("SUDO_USER"),
+        "install script should target the sudo-invoking operator instead of a hard-coded account"
+    );
+}