diff --git a/Makefile b/Makefile
index e94688a3..82d4925b 100644
--- a/Makefile
+++ b/Makefile
@@ -19,8 +19,7 @@ version:
 COMPOSE = docker compose -f docker-compose.yml -f docker-compose.managed.yml -f docker-compose.selfservice.yml
 
 up:
-	$(COMPOSE) build --no-cache
-	$(COMPOSE) up -d
+	$(COMPOSE) up -d --build
 
 down:
 	$(COMPOSE) down
diff --git a/internal/channels/zalo/personal/auth.go b/internal/channels/zalo/personal/auth.go
index 5eb76084..460517ef 100644
--- a/internal/channels/zalo/personal/auth.go
+++ b/internal/channels/zalo/personal/auth.go
@@ -92,7 +92,7 @@ func saveCredentials(path string, cred *protocol.Credentials) error {
 	if cred == nil {
 		return nil
 	}
-	if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(path), 0700); err != nil {
 		return err
 	}
 	data, err := json.MarshalIndent(cred, "", "  ")
diff --git a/internal/channels/zalo/personal/policy.go b/internal/channels/zalo/personal/policy.go
index 636b61ea..b5c2a320 100644
--- a/internal/channels/zalo/personal/policy.go
+++ b/internal/channels/zalo/personal/policy.go
@@ -50,7 +50,8 @@ func (c *Channel) checkDMPolicy(senderID, chatID string) bool {
 }
 
 func (c *Channel) sendPairingReply(senderID, chatID string) {
-	if c.pairingService == nil || c.sess == nil {
+	sess := c.session()
+	if c.pairingService == nil || sess == nil {
 		return
 	}
 
@@ -74,7 +75,7 @@ func (c *Channel) sendPairingReply(senderID, chatID string) {
 
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
-	if _, err := protocol.SendMessage(ctx, c.sess, chatID, protocol.ThreadTypeUser, replyText); err != nil {
+	if _, err := protocol.SendMessage(ctx, sess, chatID, protocol.ThreadTypeUser, replyText); err != nil {
 		slog.Warn("zalo_personal: failed to send pairing reply", "error", err)
 	} else {
 		c.pairingDebounce.Store(senderID, time.Now())
@@ -103,7 +104,12 @@ func (c *Channel) checkGroupPolicy(senderID, groupID string, mentions []*protoco
 
 	// @mention gating: only process group messages that @mention the bot.
 	if c.requireMention {
-		if !isBotMentioned(c.sess.UID, mentions) {
+		sess := c.session()
+		botUID := ""
+		if sess != nil {
+			botUID = sess.UID
+		}
+		if !isBotMentioned(botUID, mentions) {
 			slog.Debug("zalo_personal group message skipped: not mentioned",
 				"group_id", groupID,
 				"sender_id", senderID,