@@ -172,9 +172,6 @@ func (s *ConfigStore) atomicWrite(scope Scope, fn func(current []byte) ([]byte,
172172 return err
173173 }
174174
175− if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
176− return fmt.Errorf("create config directory: %w", err)
177− }
178175 return atomicWriteFile(path, newData, 0o600)
179176}
180177
@@ -221,11 +218,20 @@ func (s *ConfigStore) SetConfigField(scope Scope, key string, value any) error {
221218// The write is protected by an in-process mutex and a cross-process flock
222219// to prevent races between concurrent writers in different processes.
223220func (s *ConfigStore) SetConfigFields(scope Scope, kv map[string]any) error {
221+ // Sort keys for deterministic output regardless of map iteration
222+ // order. This also ensures consistent results when callers pass
223+ // overlapping JSONPath keys (e.g. "a" and "a.b").
224+ keys := make([]string, 0, len(kv))
225+ for k := range kv {
226+ keys = append(keys, k)
227+ }
228+ slices.Sort(keys)
229+
224230 err := s.atomicWrite(scope, func(data []byte) ([]byte, error) {
225231 v := string(data)
226− for key, value := range kv {
232+ for _, key := range keys {
227233 var sErr error
228− v, sErr = sjson.Set(v, key, value)
234+ v, sErr = sjson.Set(v, key, kv[key])
229235 if sErr != nil {
230236 return nil, fmt.Errorf("failed to set config field %s: %w", key, sErr)
231237 }