diff --git a/DEPLOY.md b/DEPLOY.md
index 6faf2b7..994b0af 100644
--- a/DEPLOY.md
+++ b/DEPLOY.md
@@ -94,6 +94,14 @@ ssh administrator@172.18.136.92 "chmod +x ~/SDP/bin/agent-micro"
 ssh administrator@172.18.139.186 "chmod +x ~/SDP/bin/control-plane ~/SDP/bin/agent-gateway"
 ```
 
+**Pre-create the control plane's data dir on 186** (SQLite + log files live here):
+
+```bash
+ssh administrator@172.18.139.186 "mkdir -p ~/SDP/data && ls -ld ~/SDP/data"
+```
+
+Should print `drwxr-xr-x ... administrator administrator ... /home/administrator/SDP/data`. The control plane binary creates it on first run too, but doing it now means the systemd unit's `ReadWritePaths` check has somewhere to point at.
+
 ## 5. Push the systemd unit files
 
 From your laptop. `scp` will prompt for the password.
@@ -123,8 +131,9 @@ Status should be `active (running)`. Journal should show a clean startup, then e
 ### 8b. 186 (control plane FIRST, then gateway agent)
 
 ```bash
-ssh administrator@172.18.139.186
 sudo install -m 644 -o root -g root /tmp/sdp-control-plane.service /etc/systemd/system/sdp-control-plane.service
+sudo mkdir -p /home/administrator/SDP/data
+sudo chown administrator:administrator /home/administrator/SDP/data
 sudo systemctl daemon-reload
 sudo systemctl enable sdp-control-plane.service
 sudo systemctl restart sdp-control-plane.service