diff --git a/prod-run.sh b/prod-run.sh
index 47c4981..23c268b 100755
--- a/prod-run.sh
+++ b/prod-run.sh
@@ -33,6 +33,10 @@ say()  { printf '[%s] %s\n'        "$APP_NAME" "$*"; }
 warn() { printf '[%s][warn] %s\n'  "$APP_NAME" "$*" >&2; }
 err()  { printf '[%s][error] %s\n' "$APP_NAME" "$*" >&2; }
 
+# Escape a string for safe use as a literal substring in an ERE/BRE regex.
+# Escapes every character that is not alphanumeric, underscore, or forward-slash.
+esc_regex_str() { printf '%s' "$1" | sed 's/[^[:alnum:]_/]/\\&/g'; }
+
 
 SERVICE_USER="$APP_NAME"
 SERVICE_GROUP="$APP_NAME"
@@ -318,7 +322,7 @@ KillSignal=SIGTERM
 TimeoutStopSec=20
 StandardOutput=append:${MAIN_LOG}
 StandardError=append:${ERROR_LOG}
-ReadWritePaths=${PROJECT_DIR}/logs ${PROJECT_DIR}/data
+ReadWritePaths=${PROJECT_DIR}/logs ${PROJECT_DIR}/data ${PROJECT_DIR}/qa
 ProtectSystem=strict
 ProtectHome=true
 PrivateTmp=true
@@ -404,9 +408,11 @@ if ! touch "$ENDPOINT_LOG" "$ENDPOINT_ERR" 2>/dev/null; then
     warn "Cannot write to $ENDPOINT_LOG_DIR — falling back to /tmp for endpoint logs"
     ENDPOINT_LOG="/tmp/runewager-backend.log"
     ENDPOINT_ERR="/tmp/runewager-backend-error.log"
-    touch "$ENDPOINT_LOG" "$ENDPOINT_ERR" || true
+    touch "$ENDPOINT_LOG" "$ENDPOINT_ERR" 2>/dev/null || true
 fi
 
+_esc_dir="$(esc_regex_str "$PROJECT_DIR")"
+
 if command -v systemctl >/dev/null 2>&1; then
     # Install/refresh the service unit from repo copy
     if [[ -f "$ENDPOINT_SERVICE_SRC" ]]; then
@@ -429,7 +435,6 @@ if command -v systemctl >/dev/null 2>&1; then
         say "runewager-endpoint restarted via systemd"
     else
         warn "systemctl restart runewager-endpoint failed — falling back to nohup"
-        _esc_dir="$(printf '%s' "$PROJECT_DIR" | sed 's/[.[\*^$()+?{|]/\\&/g')"
         pkill -f "node .*${_esc_dir}/backend\.js" 2>/dev/null || true
         sleep 1
         # Re-check port: another process may have bound it during the failed systemd restart window
@@ -445,7 +450,6 @@ if command -v systemctl >/dev/null 2>&1; then
     fi
 else
     # No systemd — direct nohup
-    _esc_dir="$(printf '%s' "$PROJECT_DIR" | sed 's/[.[\*^$()+?{|]/\\&/g')"
     pkill -f "node .*${_esc_dir}/backend\.js" 2>/dev/null || true
     sleep 1
     if is_port_listening "$ENDPOINT_PORT"; then