diff --git a/mindspace-service/scripts/run-mindspace-prod.sh b/mindspace-service/scripts/run-mindspace-prod.sh
index a112071..aa08e2c 100644
--- a/mindspace-service/scripts/run-mindspace-prod.sh
+++ b/mindspace-service/scripts/run-mindspace-prod.sh
@@ -4,6 +4,14 @@ set -euo pipefail
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 MEMIND_ROOT="${MEMIND_SHARED_ROOT:-/Users/john/Project/Memind}"
 
+# The standalone MindSpace service may read shared Memind secrets from the
+# Portal env, but its own data roots must stay owned by the standalone service
+# root. Preserve explicitly inherited standalone root overrides, then clear any
+# values that may be sourced from the monolith env below.
+EXPLICIT_MINDSPACE_SERVICE_H5_ROOT="${MINDSPACE_SERVICE_H5_ROOT-}"
+EXPLICIT_MINDSPACE_STORAGE_ROOT="${MINDSPACE_STORAGE_ROOT-}"
+EXPLICIT_H5_USERS_ROOT="${H5_USERS_ROOT-}"
+
 if [[ -f "${MEMIND_ROOT}/.env" ]]; then
   set -a
   # shellcheck disable=SC1090
@@ -11,11 +19,38 @@ if [[ -f "${MEMIND_ROOT}/.env" ]]; then
   set +a
 fi
 
+if [[ -z "${EXPLICIT_MINDSPACE_SERVICE_H5_ROOT}" ]]; then
+  unset MINDSPACE_SERVICE_H5_ROOT
+fi
+if [[ -z "${EXPLICIT_MINDSPACE_STORAGE_ROOT}" ]]; then
+  unset MINDSPACE_STORAGE_ROOT
+fi
+if [[ -z "${EXPLICIT_H5_USERS_ROOT}" ]]; then
+  unset H5_USERS_ROOT
+fi
+
+if [[ -f "${ROOT}/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "${ROOT}/.env"
+  set +a
+fi
+
+if [[ -n "${EXPLICIT_MINDSPACE_SERVICE_H5_ROOT}" ]]; then
+  export MINDSPACE_SERVICE_H5_ROOT="${EXPLICIT_MINDSPACE_SERVICE_H5_ROOT}"
+fi
+if [[ -n "${EXPLICIT_MINDSPACE_STORAGE_ROOT}" ]]; then
+  export MINDSPACE_STORAGE_ROOT="${EXPLICIT_MINDSPACE_STORAGE_ROOT}"
+fi
+if [[ -n "${EXPLICIT_H5_USERS_ROOT}" ]]; then
+  export H5_USERS_ROOT="${EXPLICIT_H5_USERS_ROOT}"
+fi
+
 export NODE_ENV=production
 export MINDSPACE_MEMIND_ROOT="${MINDSPACE_MEMIND_ROOT:-${ROOT}/memind-source}"
 export MINDSPACE_SERVICE_H5_ROOT="${MINDSPACE_SERVICE_H5_ROOT:-${MEMIND_ROOT}}"
-export MINDSPACE_STORAGE_ROOT="${MINDSPACE_STORAGE_ROOT:-${MEMIND_ROOT}/data/mindspace}"
-export H5_USERS_ROOT="${H5_USERS_ROOT:-${MEMIND_ROOT}/users}"
+export MINDSPACE_STORAGE_ROOT="${MINDSPACE_STORAGE_ROOT:-${ROOT}/data/mindspace}"
+export H5_USERS_ROOT="${H5_USERS_ROOT:-${ROOT}/users}"
 export MINDSPACE_SERVICE_PORT="${MINDSPACE_SERVICE_PORT:-8082}"
 export MINDSPACE_SERVICE_HOST="${MINDSPACE_SERVICE_HOST:-127.0.0.1}"
 export MINDSPACE_REMOTE_AUTH_TOKEN="${MINDSPACE_REMOTE_AUTH_TOKEN:-${TKMIND_SERVER__SECRET_KEY:-}}"
diff --git a/scripts/build-mindspace-service-runtime.mjs b/scripts/build-mindspace-service-runtime.mjs
index bbe5db9..e273ed7 100644
--- a/scripts/build-mindspace-service-runtime.mjs
+++ b/scripts/build-mindspace-service-runtime.mjs
@@ -128,7 +128,11 @@ async function writeMetadata() {
     '',
     'Production runtime target:',
     '  /Users/john/MindSpace',
-    'Shared persisted data root:',
+    'Standalone persisted data root:',
+    '  /Users/john/MindSpace/data/mindspace',
+    'Standalone users root:',
+    '  /Users/john/MindSpace/users',
+    'Shared Portal/H5 root:',
     '  /Users/john/Project/Memind',
     '',
     'This artifact contains:',
@@ -145,7 +149,8 @@ async function writeMetadata() {
     '  users/ runtime data',
     '  .env / .env.local',
     '',
-    'The production service keeps using shared persisted paths from /Users/john/Project/Memind.',
+    'The production service may read shared Portal secrets from /Users/john/Project/Memind/.env,',
+    'but standalone MindSpace data paths must stay under /Users/john/MindSpace.',
     '',
     `Git head ref: ${head.trim()}`,
   ].join('\n');
diff --git a/scripts/release-mindspace-service-prod.sh b/scripts/release-mindspace-service-prod.sh
index c25f0db..0598480 100644
--- a/scripts/release-mindspace-service-prod.sh
+++ b/scripts/release-mindspace-service-prod.sh
@@ -279,6 +279,10 @@ cat > "${SERVICE_PLIST}" <<EOF
     <string>8082</string>
     <key>MINDSPACE_SERVICE_HOST</key>
     <string>127.0.0.1</string>
+    <key>MINDSPACE_STORAGE_ROOT</key>
+    <string>${APP_DIR}/data/mindspace</string>
+    <key>H5_USERS_ROOT</key>
+    <string>${APP_DIR}/users</string>
     <key>MINDSPACE_SERVICE_AGENT_WORKER_ENABLED</key>
     <string>true</string>
     <key>MINDSPACE_SERVICE_WORKSPACE_MAINTENANCE</key>
@@ -306,6 +310,7 @@ mv "${NEW_DIR}" "${APP_DIR}"
 APP_MOVED=1
 
 say "启动 MindSpace service"
+mkdir -p "${APP_DIR}/data/mindspace" "${APP_DIR}/users"
 launchctl bootstrap "${LAUNCHD_GUI}" "${SERVICE_PLIST}" >/dev/null 2>&1 || true
 launchctl enable "${LAUNCHD_GUI}/${SERVICE_LABEL}" >/dev/null 2>&1 || true
 launchctl kickstart -k "${LAUNCHD_GUI}/${SERVICE_LABEL}" >/dev/null 2>&1 || true