diff --git a/deploy.sh b/deploy.sh
index 9d867dd..d94df9b 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -80,15 +80,19 @@ fi
 
 # ── 3. Ownership ──────────────────────────────────────────────────────────────
 step "File ownership and permissions"
-# Only chown what the service needs to write at runtime.
 # Source code stays owned by the invoking user.
+# pipekit needs to own pipekit.db and write to the repo directory
+# (SQLite creates journal files alongside the db file).
 DB_FILE="$REPO_DIR/pipekit.db"
 if [ -f "$DB_FILE" ]; then
-    echo "  $DB_FILE → $SERVICE_NAME"
+    echo "  $DB_FILE → $SERVICE_NAME:$SERVICE_NAME"
     chown "$SERVICE_NAME:$SERVICE_NAME" "$DB_FILE"
 else
     echo "  $DB_FILE not yet created (pipekit init will create it as $SERVICE_NAME)"
 fi
+echo "  $REPO_DIR (directory only) → group $SERVICE_NAME, group-writable"
+chgrp "$SERVICE_NAME" "$REPO_DIR"
+chmod g+w "$REPO_DIR"
 echo "  $VENV_DIR → $SERVICE_NAME (created/managed below)"
 echo "  Done."
 
@@ -101,6 +105,8 @@ fi
 
 if [ ! -d "$VENV_DIR" ]; then
     echo "  Creating venv at $VENV_DIR"
+    mkdir -p "$VENV_DIR"
+    chown "$SERVICE_NAME:$SERVICE_NAME" "$VENV_DIR"
     sudo -u "$SERVICE_NAME" HOME=/nonexistent python3 -m venv "$VENV_DIR"
 else
     echo "  Venv already exists at $VENV_DIR."
diff --git a/pipekit/cli.py b/pipekit/cli.py
index 4c9df0c..5dcea57 100644
--- a/pipekit/cli.py
+++ b/pipekit/cli.py
@@ -71,7 +71,9 @@ def cmd_drivers_register(args) -> int:
               f"(registering anyway)")
 
     name = args.name or f"{args.kind}-jdbc"
-    existing = repo.get_driver_by_name(name)
+    # Match by kind first (the meaningful key), fall back to name.
+    existing_by_kind = [d for d in repo.list_drivers() if d["kind"] == args.kind]
+    existing = existing_by_kind[0] if existing_by_kind else repo.get_driver_by_name(name)
     if existing:
         row = repo.update_driver(existing["id"], jar_file=args.jar,
                                  class_name=class_name,