diff --git a/backend-compliance/compliance/services/specialist_agents/_evidence_vault.py b/backend-compliance/compliance/services/specialist_agents/_evidence_vault.py
index 44fa8572..c0cf71c6 100644
--- a/backend-compliance/compliance/services/specialist_agents/_evidence_vault.py
+++ b/backend-compliance/compliance/services/specialist_agents/_evidence_vault.py
@@ -50,9 +50,10 @@ logger = logging.getLogger(__name__)
 
 
 def _vault_root() -> Path:
-    """Resolved at call time so tests can monkeypatch the env var."""
+    """Resolved at call time so tests can monkeypatch the env var.
+    Default to /tmp so the appuser can always write (container-friendly)."""
     return Path(os.environ.get(
-        "EVIDENCE_VAULT_ROOT", "/app/artifacts/agent_runs",
+        "EVIDENCE_VAULT_ROOT", "/tmp/breakpilot/agent_runs",
     ))