diff --git a/docker/opencode/entrypoint.sh b/docker/opencode/entrypoint.sh
index ffdf866..ebc2ae6 100644
--- a/docker/opencode/entrypoint.sh
+++ b/docker/opencode/entrypoint.sh
@@ -15,6 +15,20 @@ ln -sfn "$GROWQR_HOME/prompts" /root/.config/opencode/prompts
 ln -sfn "$GROWQR_HOME/agents" /root/.local/share/opencode/agents
 ln -sfn "$GROWQR_HOME/prompts" /root/.local/share/opencode/prompts
 
+# OpenCode runs with /workspace as the project root. GrowQR prompt packs live in
+# /opt/growqr, so allow read/glob/grep access there without interactive approval;
+# otherwise backend API calls can hang waiting on an approval prompt.
+cat > /root/.config/opencode/opencode.jsonc <<EOF
+{
+  "\$schema": "https://opencode.ai/config.json",
+  "permission": {
+    "external_directory": {
+      "$GROWQR_HOME/**": "allow"
+    }
+  }
+}
+EOF
+
 # Seed an empty mounted workspace with the GrowQR Git-backed memory shape. The
 # backend later clones the user's central Gitea repo over this workspace when it
 # provisions the user stack. This only runs for truly empty workspaces.