diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 291950e95e0..ec5841dea6c 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -124,7 +124,7 @@ jobs:
             ${{ runner.temp }}/paperclip-health.json
             ${{ runner.temp }}/paperclip-company.json
             ${{ runner.temp }}/hermes-gateway-e2e.log
-            ${{ runner.temp }}/hermes-gateway-diag/
+            ${{ env.HERMES_SMOKE_DIAG_DIR }}/
           retention-days: 14
           if-no-files-found: ignore
 
diff --git a/scripts/smoke/hermes-gateway-e2e.sh b/scripts/smoke/hermes-gateway-e2e.sh
index da832f8e6f6..ab41893b659 100755
--- a/scripts/smoke/hermes-gateway-e2e.sh
+++ b/scripts/smoke/hermes-gateway-e2e.sh
@@ -462,7 +462,9 @@ prepare_fresh_state() {
     "${HERMES_SMOKE_STATE_DIR}/hermes-home" \
     "${HERMES_SMOKE_STATE_DIR}/workspace" \
     "${HERMES_SMOKE_STATE_DIR}/fake-host-home/.hermes"
-  chmod 700 "${HERMES_SMOKE_STATE_DIR}/hermes-home" "${HERMES_SMOKE_STATE_DIR}/workspace" || true
+  # These host-created bind mounts must be readable and writable by the
+  # non-root hermes user (uid 10001) inside the container.
+  chmod 777 "${HERMES_SMOKE_STATE_DIR}/hermes-home" "${HERMES_SMOKE_STATE_DIR}/workspace" || true
   echo "host hermes sentinel ${RUN_SUFFIX}" > "${HERMES_SMOKE_STATE_DIR}/fake-host-home/.hermes/host-sentinel.txt"
 
   if find "${HERMES_SMOKE_STATE_DIR}/hermes-home" -mindepth 1 -print -quit | grep -q .; then