diff --git a/docker/nginx/nginx.local.conf b/docker/nginx/nginx.local.conf
index 035406862..16c7de0b1 100644
--- a/docker/nginx/nginx.local.conf
+++ b/docker/nginx/nginx.local.conf
@@ -1,3 +1,7 @@
+# Global error_log (main context). Without this, nginx opens its compiled-in
+# default (/var/log/nginx/error.log) at startup before reaching the http-block
+# error_log, which fails with permission denied when run as a non-root user.
+error_log logs/nginx-error.log warn;
 events {
     worker_connections 1024;
 }
diff --git a/scripts/serve.sh b/scripts/serve.sh
index aac16f1fc..bc8d58938 100755
--- a/scripts/serve.sh
+++ b/scripts/serve.sh
@@ -105,7 +105,7 @@ _is_deerflow_pid() {
         return 0
     fi
 
-    files=$(lsof -p "$pid" 2>/dev/null) || return 1
+    files=$(lsof -b -w -p "$pid" 2>/dev/null) || return 1
     while IFS= read -r root; do
         [ -n "$root" ] || continue
         case "$files" in
@@ -122,7 +122,7 @@ _report_reclaimed_ports() {
     for port in 8001 3000 2026; do
         for pid in $(lsof -nP -iTCP:"$port" -sTCP:LISTEN -t 2>/dev/null); do
             _is_deerflow_pid "$pid" || continue
-            files=$(lsof -p "$pid" 2>/dev/null)
+            files=$(lsof -b -w -p "$pid" 2>/dev/null)
             case "$files" in *"$REPO_ROOT"/*) continue ;; esac  # this worktree — normal
             owner=""
             while IFS= read -r root; do