diff --git a/apps/base/logging/nats-bootstrap-job.yaml b/apps/base/logging/nats-bootstrap-job.yaml
index 5e2fc68..dd27630 100644
--- a/apps/base/logging/nats-bootstrap-job.yaml
+++ b/apps/base/logging/nats-bootstrap-job.yaml
@@ -59,6 +59,11 @@ spec:
       containers:
         - name: nats-bootstrap
           image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/natsio/nats-box:0.18.0
+          # nats CLI stats the working directory when loading its response
+          # schemas; under readOnlyRootFilesystem + runAsUser 1000 the image's
+          # default WORKDIR is not accessible ("stat .: permission denied"), so
+          # run from the writable /tmp emptyDir.
+          workingDir: /tmp
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true