diff --git a/image-recipe/_archived/build-auto-installer-iso.sh b/image-recipe/_archived/build-auto-installer-iso.sh
index dbd0751c..9e88e2bf 100755
--- a/image-recipe/_archived/build-auto-installer-iso.sh
+++ b/image-recipe/_archived/build-auto-installer-iso.sh
@@ -212,18 +212,25 @@ check_tools() {
     fi
 
     # Ensure insecure registry config for Archipelago app registries that are
-    # intentionally served over HTTP during ISO builds.
+    # intentionally served over HTTP during ISO builds. Rootless podman reads
+    # the per-user config dir; only root can write /etc. Never fatal — the
+    # node may already carry this config.
     if [[ "$CONTAINER_CMD" == podman* ]]; then
-        mkdir -p /etc/containers/registries.conf.d
-        cat > /etc/containers/registries.conf.d/archipelago.conf <<'REGCONF'
-[[registry]]
-location = "146.59.87.168:3000"
-insecure = true
-
+        if [ "$(id -u)" = "0" ]; then
+            REGCONF_DIR="/etc/containers/registries.conf.d"
+        else
+            REGCONF_DIR="${HOME}/.config/containers/registries.conf.d"
+        fi
+        if mkdir -p "$REGCONF_DIR" 2>/dev/null && cat > "$REGCONF_DIR/archipelago.conf" 2>/dev/null <<'REGCONF'
 [[registry]]
 location = "146.59.87.168:3000"
 insecure = true
 REGCONF
+        then
+            :
+        else
+            echo "   ⚠️  Could not write $REGCONF_DIR/archipelago.conf — assuming registry config already present"
+        fi
     fi
 }