diff --git a/README.md b/README.md
index 2ae39ff..297a9f1 100644
--- a/README.md
+++ b/README.md
@@ -174,11 +174,12 @@ the all-seer's view, not Idunn's contract, and the two sets do not overlap.
 | `idunn-yggdrasil` | operator wrapper |
 | `idunn-yggdrasil.sudoers` | the narrow sudo grant the wrapper needs |
 
-The unit runs as a dedicated `idunn` user under `ProtectSystem=full`,
-`ProtectHome=yes`, `PrivateTmp=yes`. `ReadWritePaths` is Idunn's own state plus
-the build root; the operator anchor, the bindings, and Odin's correlation store
-are all `ReadOnlyPaths`. Idunn admits against operator authority — it does not
-author it.
+The unit runs as root under `ProtectSystem=full`,
+`ProtectHome=yes`, `PrivateTmp=yes`. `ReadWritePaths` contains Idunn's own state,
+the build root, and only the runtime, state, and release roots explicitly
+granted to each managed target. The operator anchor, bindings, and Odin's
+correlation store remain read-only. Idunn admits against operator authority —
+it does not author it.
 
 Note `Wants=docker.service`, not `Requires=`. Only the build step is
 containerized; warm, fence, promote, drain and restart run on systemd, and
diff --git a/deploy/idunn-yggdrasil.service b/deploy/idunn-yggdrasil.service
index 989483f..5474c67 100644
--- a/deploy/idunn-yggdrasil.service
+++ b/deploy/idunn-yggdrasil.service
@@ -79,9 +79,8 @@ ReadWritePaths=/etc/ufw
 # was inside the private root, where no workload could traverse to it.
 ReadWritePaths=/var/lib/gamecult/idunn /var/lib/gamecult/idunn-authority /var/lib/gamecult/idunn-projection
 ReadWritePaths=/srv/build
-# One entry per managed target: its runtime root, state root and release root.
-# A target Idunn cannot write is a target it cannot deploy, so this list grows
-# by exactly three paths per migration and is the honest blast radius.
+# Each managed target gets only its bound roots. A target Idunn cannot write is
+# a target it cannot deploy; keep this list aligned with operator bindings.
 ReadWritePaths=/etc/gamecult/heimdall /var/lib/gamecult/heimdall /srv/heimdall/app
 # Odin is a managed target like any other now, so its three roots are writable
 # on the same terms. This used to be ReadOnlyPaths, on the reasoning that Idunn
@@ -97,6 +96,10 @@ ReadWritePaths=/etc/gamecult/odin /var/lib/gamecult/odin /srv/odin
 # which also holds the credential originals Idunn reads but never writes.
 # The release root sits beside the legacy v1 actuator's /srv/ghostlight.
 ReadWritePaths=/etc/gamecult/ghostlight/runtime /var/lib/gamecult/ghostlight-world-v2 /srv/ghostlight-idunn
+# StreamPixels service: runtime bundle, rebuildable state boundary, and releases.
+ReadWritePaths=/etc/gamecult/streampixels-service/runtime /var/lib/gamecult/streampixels-service /srv/streampixels-idunn/releases/service
+# StreamPixels web is stateless; it needs only its runtime bundle and releases.
+ReadWritePaths=/etc/gamecult/streampixels-web/runtime /srv/streampixels-idunn/releases/web
 
 [Install]
 WantedBy=multi-user.target