diff --git a/src/auth.rs b/src/auth.rs
index bb158aa..75dd532 100644
--- a/src/auth.rs
+++ b/src/auth.rs
@@ -133,10 +133,6 @@ struct AuthorizeAnnouncement<'a> {
     expires_in_seconds: u64,
 }
 
-/// Writes the authorization URL to stdout before waiting for the callback.
-///
-/// The authorization URL redirects to a loopback address, so it only completes
-/// in a browser running on the same machine as the CLI.
 fn write_authorization_notice(authorize_url: &str, options: LoginOptions) -> Result<()> {
     let notice = authorization_notice(authorize_url, options)?;
     let stdout = io::stdout();
diff --git a/src/image/mod.rs b/src/image/mod.rs
index c666b70..4272ef5 100644
--- a/src/image/mod.rs
+++ b/src/image/mod.rs
@@ -25,12 +25,14 @@ const RAILPACK_FRONTEND: &str = "ghcr.io/railwayapp/railpack-frontend:v0.35.0";
 const PROCESS_TIMEOUT: Duration = Duration::from_secs(60 * 60);
 const PROCESS_OUTPUT_DRAIN_TIMEOUT: Duration = Duration::from_secs(1);
 const NETWORK_TIMEOUT: Duration = Duration::from_secs(30 * 60);
+// Never chown /mise here: it arrives from an earlier layer, so rewriting its
+// ownership copies the entire toolchain into this one (194 MB for a Node app).
 const NON_ROOT_DOCKERFILE: &str = r#"FROM base
 RUN groupadd --gid 1000 railpack \
     && useradd --uid 1000 --gid 1000 --home-dir /home/railpack --create-home --shell /bin/false railpack \
     && if [ -d /root ]; then cp -a /root/. /home/railpack/; fi \
     && chown -R 1000:1000 /home/railpack \
-    && if [ -d /mise ]; then chown -R 1000:1000 /mise; fi
+    && if [ -d /mise ]; then install -d -o 1000 -g 1000 /mise/cache /mise/migrations; fi
 ENV HOME=/home/railpack
 USER 1000:1000
 "#;