diff --git a/Cargo.lock b/Cargo.lock
index fb5e015..8bcfd07 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1658,7 +1658,7 @@ checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
 
 [[package]]
 name = "lesavka_client"
-version = "0.25.0"
+version = "0.25.1"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -1692,7 +1692,7 @@ dependencies = [
 
 [[package]]
 name = "lesavka_common"
-version = "0.25.0"
+version = "0.25.1"
 dependencies = [
  "anyhow",
  "base64",
@@ -1704,7 +1704,7 @@ dependencies = [
 
 [[package]]
 name = "lesavka_server"
-version = "0.25.0"
+version = "0.25.1"
 dependencies = [
  "anyhow",
  "base64",
diff --git a/client/Cargo.toml b/client/Cargo.toml
index 780d24f..88cf568 100644
--- a/client/Cargo.toml
+++ b/client/Cargo.toml
@@ -4,7 +4,7 @@ path                    = "src/main.rs"
 
 [package]
 name                    = "lesavka_client"
-version                 = "0.25.0"
+version                 = "0.25.1"
 edition                 = "2024"
 
 [dependencies]
diff --git a/common/Cargo.toml b/common/Cargo.toml
index e958fe3..0a1afbf 100644
--- a/common/Cargo.toml
+++ b/common/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name                    = "lesavka_common"
-version                 = "0.25.0"
+version                 = "0.25.1"
 edition                 = "2024"
 build                   = "build.rs"
 
diff --git a/scripts/install/server.sh b/scripts/install/server.sh
index cc638ac..a5c3660 100755
--- a/scripts/install/server.sh
+++ b/scripts/install/server.sh
@@ -1,12 +1,39 @@
 #!/usr/bin/env bash
 # scripts/install/server.sh - install and setup all server related apps and environments
 set -euo pipefail
-ORIG_USER=${SUDO_USER:-$(id -un)}
 SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
 SCRIPT_REPO_ROOT=$(cd -- "$SCRIPT_DIR/../.." && pwd)
 DEFAULT_REPO_URL=ssh://git@scm.bstein.dev:2242/bstein/lesavka.git
 export TMPDIR=${TMPDIR:-/var/tmp}
 
+resolve_install_user() {
+  if [[ -n ${SUDO_USER:-} && ${SUDO_USER} != root ]]; then
+    printf '%s\n' "$SUDO_USER"
+    return 0
+  fi
+
+  local current_user
+  current_user=$(id -un)
+  if [[ $current_user != root ]]; then
+    printf '%s\n' "$current_user"
+    return 0
+  fi
+
+  local owner_uid owner_user
+  owner_uid=$(stat -c '%u' "$SCRIPT_REPO_ROOT" 2>/dev/null || true)
+  if [[ -n $owner_uid && $owner_uid != 0 ]]; then
+    owner_user=$(getent passwd "$owner_uid" | cut -d: -f1)
+    if [[ -n $owner_user ]]; then
+      printf '%s\n' "$owner_user"
+      return 0
+    fi
+  fi
+
+  printf 'root\n'
+}
+
+ORIG_USER=$(resolve_install_user)
+
 persisted_env_value() {
   local file=$1
   local key=$2
diff --git a/server/Cargo.toml b/server/Cargo.toml
index 18ca391..4d96235 100644
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -16,7 +16,7 @@ bench                   = false
 
 [package]
 name                    = "lesavka_server"
-version                 = "0.25.0"
+version                 = "0.25.1"
 edition                 = "2024"
 autobins                = false
 
diff --git a/tests/contract/scripts/install/server_install_script_contract.rs b/tests/contract/scripts/install/server_install_script_contract.rs
index 9e72dc3..02c77fe 100644
--- a/tests/contract/scripts/install/server_install_script_contract.rs
+++ b/tests/contract/scripts/install/server_install_script_contract.rs
@@ -10,6 +10,21 @@ const SERVER_INSTALL: &str = include_str!(concat!(
     "/scripts/install/server.sh"
 ));
 
+#[test]
+fn server_install_infers_checkout_owner_when_root_wrapper_hides_sudo_user() {
+    for expected in [
+        "resolve_install_user()",
+        "if [[ -n ${SUDO_USER:-} && ${SUDO_USER} != root ]]",
+        "owner_uid=$(stat -c '%u' \"$SCRIPT_REPO_ROOT\"",
+        "ORIG_USER=$(resolve_install_user)",
+    ] {
+        assert!(
+            SERVER_INSTALL.contains(expected),
+            "install script should include root-wrapper install user inference: {expected}"
+        );
+    }
+}
+
 #[test]
 fn server_install_pins_hdmi_camera_and_display_defaults() {
     for expected in [