diff --git a/Makefile b/Makefile
index 25426b4d8..95bd3f993 100644
--- a/Makefile
+++ b/Makefile
@@ -29,6 +29,10 @@ MAKE := make
 XARGS := xargs -L 1
 UNAME_S := $(shell uname -s)
 
+# Use docker by default; allow overrides and detect podman wrapper.
+DOCKER ?= docker
+IS_PODMAN := $(shell $(DOCKER) --version 2>/dev/null | grep -qi podman && echo 1 || echo 0)
+
 include make/testing_flags.mk
 include make/release_flags.mk
 include make/fuzz_flags.mk
@@ -74,7 +78,7 @@ endif
 # Paths inside container must match GOCACHE/GOMODCACHE in tools/Dockerfile.
 ifdef CI
 # CI mode: bind mount to host paths that GitHub Actions caches.
-DOCKER_TOOLS = docker run \
+DOCKER_TOOLS = $(DOCKER) run \
   --rm \
   -v $${HOME}/.cache/go-build:/tmp/build/.cache \
   -v $${HOME}/go/pkg/mod:/tmp/build/.modcache \
@@ -83,7 +87,7 @@ DOCKER_TOOLS = docker run \
   -v $$(pwd):/build taproot-assets-tools
 else
 # Local mode: Docker named volumes for fast macOS/Windows performance.
-DOCKER_TOOLS = docker run \
+DOCKER_TOOLS = $(DOCKER) run \
   --rm \
   -v tapd-go-build-cache:/tmp/build/.cache \
   -v tapd-go-mod-cache:/tmp/build/.modcache \
@@ -175,7 +179,7 @@ docker-release:
 	@$(call print, "Building release helper docker image.")
 	if [ "$(tag)" = "" ]; then echo "Must specify tag=<commit_or_tag>!"; exit 1; fi
 
-	docker build -t taproot-assets-release-helper -f make/builder.Dockerfile make/
+	$(DOCKER) build -t taproot-assets-release-helper -f make/builder.Dockerfile make/
 
 	# Run the actual compilation inside the docker image. We pass in all flags
 	# that we might want to overwrite in manual tests.
@@ -183,7 +187,7 @@ docker-release:
 
 docker-tools:
 	@$(call print, "Building tools docker image.")
-	docker build -q -t taproot-assets-tools $(TOOLS_DIR)
+	$(DOCKER) build -q -t taproot-assets-tools $(TOOLS_DIR)
 
 scratch: build
 
diff --git a/make/release_flags.mk b/make/release_flags.mk
index d4e333a1f..8d747656e 100644
--- a/make/release_flags.mk
+++ b/make/release_flags.mk
@@ -8,9 +8,19 @@ VERSION_TAG = $(tag)
 VERSION_CHECK = ./scripts/release.sh check-tag "$(VERSION_TAG)" "$(VERSION_GO_FILE)"
 endif
 
-DOCKER_RELEASE_HELPER = docker run \
+# Use DOCKER/IS_PODMAN from Makefile.
+
+# For Podman rootless, use --user=0:0 to avoid permission issues.
+# For Docker, use current user to ensure generated files are user-owned.
+ifeq ($(IS_PODMAN),1)
+USER_ARGS = --user=0:0
+else
+USER_ARGS = --user $(shell id -u):$(shell id -g)
+endif
+
+DOCKER_RELEASE_HELPER = $(DOCKER) run \
   --rm \
-  --user $(shell id -u):$(shell id -g) \
+  $(USER_ARGS) \
   -v $(shell pwd):/tmp/build/taproot-assets \
   -v $(shell bash -c "go env GOCACHE || (mkdir -p /tmp/go-cache; echo /tmp/go-cache)"):/tmp/build/.cache \
   -v $(shell bash -c "go env GOMODCACHE || (mkdir -p /tmp/go-modcache; echo /tmp/go-modcache)"):/tmp/build/.modcache \
diff --git a/scripts/docker_helpers.sh b/scripts/docker_helpers.sh
new file mode 100644
index 000000000..6e5ba6907
--- /dev/null
+++ b/scripts/docker_helpers.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+# docker_helpers.sh: Common Docker/Podman detection and configuration
+#
+# This script should be sourced by other scripts that need to run Docker or
+# Podman commands. It sets up the DOCKER variable and user_args array based
+# on whether Docker or Podman is being used.
+#
+# Usage:
+#   source scripts/docker_helpers.sh
+#   "$DOCKER" run "${user_args[@]}" ...
+
+# Use docker by default; allow overrides and detect podman wrapper.
+DOCKER=${DOCKER:-docker}
+user_args=(--user "$UID:$(id -g)")
+if "$DOCKER" --version 2>/dev/null | grep -qi podman; then
+	user_args=(--user=0:0)
+fi
diff --git a/scripts/gen_sqlc_docker.sh b/scripts/gen_sqlc_docker.sh
index ddc6e9d36..d578ba17d 100755
--- a/scripts/gen_sqlc_docker.sh
+++ b/scripts/gen_sqlc_docker.sh
@@ -2,6 +2,12 @@
 
 set -e
 
+# Directory of the script file, independent of where it's called from.
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# Source Docker/Podman detection helper.
+source "$DIR/docker_helpers.sh"
+
 # restore_files is a function to restore original schema files.
 restore_files() {
 	echo "Restoring SQLite bigint patch..."
@@ -14,9 +20,6 @@ restore_files() {
 # are always restored.
 trap restore_files EXIT
 
-# Directory of the script file, independent of where it's called from.
-DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-
 # Use the user's cache directories.
 GOCACHE=$(go env GOCACHE)
 GOMODCACHE=$(go env GOMODCACHE)
@@ -40,9 +43,9 @@ echo "Generating sql models and queries in go..."
 
 # Run the script to generate the new generated code. Once the script exits, we
 # use `trap` to make sure all files are restored.
-docker run \
+"$DOCKER" run \
 	--rm \
-	--user "$UID:$(id -g)" \
+	"${user_args[@]}" \
 	-e UID=$UID \
 	-v "$DIR/../:/build" \
 	-w /build \
diff --git a/taprpc/gen_protos_docker.sh b/taprpc/gen_protos_docker.sh
index 41993cacb..472dacdcf 100755
--- a/taprpc/gen_protos_docker.sh
+++ b/taprpc/gen_protos_docker.sh
@@ -5,21 +5,24 @@ set -e
 # Directory of the script file, independent of where it's called from.
 DIR="$(cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd)"
 
+# Source Docker/Podman detection helper.
+source "$DIR/../scripts/docker_helpers.sh"
+
 PROTOBUF_VERSION=$(go list -f '{{.Version}}' -m google.golang.org/protobuf)
 GRPC_GATEWAY_VERSION=$(go list -f '{{.Version}}' -m github.com/grpc-ecosystem/grpc-gateway/v2)
 LND_VERSION=$(go list -f '{{.Version}}' -m github.com/lightningnetwork/lnd)
 
 echo "Building protobuf compiler docker image..."
-docker build -t taproot-assets-protobuf-builder \
+"$DOCKER" build -t taproot-assets-protobuf-builder \
   --build-arg PROTOBUF_VERSION="$PROTOBUF_VERSION" \
   --build-arg GRPC_GATEWAY_VERSION="$GRPC_GATEWAY_VERSION" \
   --build-arg LND_VERSION="$LND_VERSION" \
   .
 
 echo "Compiling and formatting *.proto files..."
-docker run \
+"$DOCKER" run \
   --rm \
-  --user "$UID:$(id -g)" \
+  "${user_args[@]}" \
   -e UID=$UID \
   -e COMPILE_MOBILE \
   -e SUBSERVER_PREFIX \