diff --git a/ansible/roles/alloy/tasks/main.yml b/ansible/roles/alloy/tasks/main.yml
index 00111ea..211cc5b 100644
--- a/ansible/roles/alloy/tasks/main.yml
+++ b/ansible/roles/alloy/tasks/main.yml
@@ -38,6 +38,16 @@
     - /var/db/alloy
   when: ansible_facts["os_family"] == "FreeBSD"
 
+# ── Docker socket access ─────────────────────────────────────────────────────
+
+- name: Add alloy to docker group
+  ansible.builtin.user:
+    name: alloy
+    groups: docker
+    append: true
+  when: "'docker_hosts' in group_names"
+  notify: "Restart alloy ({{ ansible_facts['os_family'] }})"
+
 # ── Config — all OS ───────────────────────────────────────────────────────────
 
 - name: Set alloy config path fact