diff --git a/Workers/Resgrid.Workers.Console/Program.cs b/Workers/Resgrid.Workers.Console/Program.cs
index 4b8d8e8a0..bf66938c4 100644
--- a/Workers/Resgrid.Workers.Console/Program.cs
+++ b/Workers/Resgrid.Workers.Console/Program.cs
@@ -146,9 +146,6 @@ private static void LoadConfiguration(string[] args)
 
 		private static void SetConnectionString()
 		{
-			var config = System.Configuration.ConfigurationManager.OpenExeConfiguration(ConfigurationUserLevel.None);
-			var connectionStringsSection = (ConnectionStringsSection)config.GetSection("connectionStrings");
-
 			string configPath = Configuration["AppOptions:ConfigPath"];
 
 			if (string.IsNullOrWhiteSpace(configPath))
@@ -182,13 +179,10 @@ private static void SetConnectionString()
 				}
 			}
 
-			if (connectionStringsSection.ConnectionStrings["ResgridContext"] != null)
-				connectionStringsSection.ConnectionStrings["ResgridContext"].ConnectionString = DataConfig.ConnectionString;
-			else
-				connectionStringsSection.ConnectionStrings.Add(new ConnectionStringSettings("ResgridContext", DataConfig.ConnectionString));
-
-			config.Save();
-			System.Configuration.ConfigurationManager.RefreshSection("connectionStrings");
+			// Previously this also persisted ConnectionStrings to the on-disk .dll.config via config.Save().
+			// That fails on read-only / non-root hardened (DHI) containers and is unnecessary: the in-memory
+			// injection above is what downstream ConfigurationManager.ConnectionStrings consumers read
+			// (this mirrors the web apps' Startup, which only inject in-memory and never write to disk).
 			collection.SetValue(settings, true);
 			element.SetValue(settings, true);
 
diff --git a/Workers/Resgrid.Workers.Events.Console/Program.cs b/Workers/Resgrid.Workers.Events.Console/Program.cs
index 661f59a99..4ea82db5a 100644
--- a/Workers/Resgrid.Workers.Events.Console/Program.cs
+++ b/Workers/Resgrid.Workers.Events.Console/Program.cs
@@ -111,20 +111,24 @@ private static void LoadConfiguration(string[] args)
 
 		private static void SetConnectionString()
 		{
-			var config = ConfigurationManager.OpenExeConfiguration(ConfigurationUserLevel.None);
-			var connectionStringsSection = (ConnectionStringsSection)config.GetSection("connectionStrings");
+			ConfigProcessor.LoadAndProcessEnvVariables(Configuration.AsEnumerable());
 
-			//var test = Configuration["ConnectionStrings:ResgridContext"];
+			// Inject the connection string into the in-memory ConfigurationManager.ConnectionStrings
+			// collection for legacy consumers. We intentionally do NOT persist the .dll.config to disk
+			// via config.Save(): that fails on read-only / non-root hardened (DHI) containers. This
+			// mirrors the web apps' Startup, which only inject in-memory and never write to disk.
+			var settings = ConfigurationManager.ConnectionStrings;
+			var element = typeof(ConfigurationElement).GetField("_readOnly", System.Reflection.BindingFlags.Instance | System.Reflection.BindingFlags.NonPublic);
+			var collection = typeof(ConfigurationElementCollection).GetField("_readOnly", System.Reflection.BindingFlags.Instance | System.Reflection.BindingFlags.NonPublic);
 
-			ConfigProcessor.LoadAndProcessEnvVariables(Configuration.AsEnumerable());
+			element.SetValue(settings, false);
+			collection.SetValue(settings, false);
 
-			if (connectionStringsSection.ConnectionStrings["ResgridContext"] != null)
-				connectionStringsSection.ConnectionStrings["ResgridContext"].ConnectionString = DataConfig.ConnectionString;
-			else
-				connectionStringsSection.ConnectionStrings.Add(new ConnectionStringSettings("ResgridContext", DataConfig.ConnectionString));
+			if (settings["ResgridContext"] == null)
+				settings.Add(new ConnectionStringSettings("ResgridContext", DataConfig.ConnectionString));
 
-			config.Save();
-			ConfigurationManager.RefreshSection("connectionStrings");
+			collection.SetValue(settings, true);
+			element.SetValue(settings, true);
 		}
 	}
 }