diff --git a/playbooks/bootstrap.yml b/playbooks/bootstrap.yml
index f235963..5e18605 100644
--- a/playbooks/bootstrap.yml
+++ b/playbooks/bootstrap.yml
@@ -175,6 +175,14 @@
         mode: "0440"
         validate: "visudo -cf %s"
 
+    - name: "[5b] add {{ managed_user }} to docker group (if docker present)"
+      ansible.builtin.user:
+        name: "{{ managed_user }}"
+        groups: docker
+        append: true
+      when: "'/usr/bin/docker' is exists or 'docker' in ansible_facts.packages | default({})"
+      failed_when: false
+
     # ---------- SAFETY CHECK: ansible key login must work ----------
     - name: "[6] SAFETY — verify {{ managed_user }} can log in via SSH key (from the runner)"
       ansible.builtin.command: >-