diff --git a/crates/vmate-cli/src/commands/all.rs b/crates/vmate-cli/src/commands/all.rs
index d98ae94..afaf794 100644
--- a/crates/vmate-cli/src/commands/all.rs
+++ b/crates/vmate-cli/src/commands/all.rs
@@ -12,16 +12,17 @@ use vmate_core::settings::UserSettings;
 use vmate_core::system::{ProcessKiller, RealProcessKiller, require_root_for};
 
 pub async fn run(settings: &Settings, args: &AllArgs, verbose: &Verbosity) -> Result<()> {
-    // --save-defaults is a pure settings operation: persist and exit without
-    // scanning or connecting (no root, no OpenVPN, no DB needed).
+    // Elevate like a real run: the config dir may need sudo (e.g. left over
+    // from a previous elevated run), so --save-defaults must not skip it.
+    require_root_for("run OpenVPN tests and connections", settings.no_elevate)?;
+
+    // --save-defaults persists and exits without scanning or connecting.
     if settings.save_defaults {
         crate::commands::scan::persist_scan_defaults(&args.scan)?;
         persist_connect_defaults(&args.connect)?;
         return Ok(());
     }
 
-    require_root_for("run OpenVPN tests and connections", settings.no_elevate)?;
-
     let us = UserSettings::load();
     let connect = resolve_connect(&us, &args.connect);
 
diff --git a/crates/vmate-cli/src/commands/connect.rs b/crates/vmate-cli/src/commands/connect.rs
index 3c5875d..d881711 100644
--- a/crates/vmate-cli/src/commands/connect.rs
+++ b/crates/vmate-cli/src/commands/connect.rs
@@ -53,15 +53,16 @@ pub(crate) fn persist_connect_defaults(args: &ConnectArgs) -> Result<()> {
 }
 
 pub async fn run(settings: &Settings, args: &ConnectArgs, verbose: &Verbosity) -> Result<()> {
-    // --save-defaults is a pure settings operation: persist and exit without
-    // connecting (no root, no OpenVPN, no DB needed).
+    // Elevate like a real run: the config dir may need sudo (e.g. left over
+    // from a previous elevated run), so --save-defaults must not skip it.
+    require_root_for("run OpenVPN connections", settings.no_elevate)?;
+
+    // --save-defaults persists and exits without connecting (no OpenVPN, no DB).
     if settings.save_defaults {
         persist_connect_defaults(args)?;
         return Ok(());
     }
 
-    require_root_for("run OpenVPN connections", settings.no_elevate)?;
-
     let us = UserSettings::load();
     let resolved = resolve_connect(&us, args);
 
diff --git a/crates/vmate-cli/src/commands/scan.rs b/crates/vmate-cli/src/commands/scan.rs
index e5e42cb..c625bb8 100644
--- a/crates/vmate-cli/src/commands/scan.rs
+++ b/crates/vmate-cli/src/commands/scan.rs
@@ -19,15 +19,16 @@ use vmate_core::system::{
 };
 
 pub async fn run(settings: &Settings, args: &ScanArgs, verbose: &Verbosity) -> Result<()> {
-    // --save-defaults is a pure settings operation: persist and exit without
-    // scanning (no root, no OpenVPN, no DB needed).
+    // Elevate like a real run: the config dir may need sudo (e.g. left over
+    // from a previous elevated run), so --save-defaults must not skip it.
+    require_root_for("run OpenVPN tests", settings.no_elevate)?;
+
+    // --save-defaults persists and exits without scanning (no OpenVPN, no DB).
     if settings.save_defaults {
         persist_scan_defaults(args)?;
         return Ok(());
     }
 
-    require_root_for("run OpenVPN tests", settings.no_elevate)?;
-
     scan_pipeline(settings, args, verbose).await?;
     Ok(())
 }