diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index aadba9e..0c0e7f0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,17 +35,27 @@ jobs:
           cp .env.example .env
           mkdir -p shared/db
           cp shared/db/datamart.duckdb.example shared/db/datamart.duckdb
-          # The Superset container runs as uid 1000 and DuckDB opens the warehouse
-          # read-write, so the bind-mounted file and its directory (for the .wal)
-          # have to be writable by a user the runner does not share a uid with.
-          chmod a+rwx shared/db
-          chmod a+rw shared/db/datamart.duckdb
 
       - name: Build images
         run: docker compose build
 
       - name: Start the stack
-        run: docker compose up --detach
+        run: |
+          set +e
+          docker compose up --detach
+          echo "::notice::compose up exit=$?"
+          set -e
+          echo "=== host-side file ==="
+          ls -ln shared/db/
+          echo "=== as seen inside superset ==="
+          docker compose exec -T superset id
+          docker compose exec -T superset ls -ln /app/superset_home/db/
+          echo "=== stored connection uri ==="
+          docker compose exec -T superset sh -lc "superset db-connection list 2>/dev/null || true"
+          echo "=== direct duckdb read_only open ==="
+          docker compose exec -T superset python -c "import duckdb; duckdb.connect('/app/superset_home/db/datamart.duckdb', read_only=True); print('read_only open OK')" || echo "read_only open FAILED"
+          echo "=== the post_start command by hand ==="
+          docker compose exec -T superset sh -lc 'superset import-dashboards -p ./dashboard.zip -u admin 2>&1 | tail -25; echo "exit=${PIPESTATUS[0]}"' || true
 
       - name: Wait for services
         run: |
diff --git a/superset/Dockerfile b/superset/Dockerfile
index 9bf1a6b..7b3c057 100644
--- a/superset/Dockerfile
+++ b/superset/Dockerfile
@@ -19,4 +19,5 @@ RUN superset fab create-admin \
               --password ${SUPERSET_PASSWORD}
 RUN superset db upgrade
 RUN superset init
-RUN superset set_database_uri -d DW  -u duckdb:///superset_home/db/datamart.duckdb
+RUN superset set_database_uri -d DW \
+    -u "duckdb:///superset_home/db/datamart.duckdb?access_mode=read_only"