diff --git a/plugin.conf b/plugin.conf
index 2289aa5..ad8348a 100644
--- a/plugin.conf
+++ b/plugin.conf
@@ -2,7 +2,7 @@ name=alt-mysql
 id=alt-mysql
 type=user
 author=HITME.PL
-version=1.2.12
+version=1.2.13
 active=no
 installed=no
 user_run_as=root
diff --git a/scripts/setup/phpmyadmin_install.sh b/scripts/setup/phpmyadmin_install.sh
index d5784d0..1dc9cac 100644
--- a/scripts/setup/phpmyadmin_install.sh
+++ b/scripts/setup/phpmyadmin_install.sh
@@ -14,6 +14,8 @@ CONFIG_INC="${PHPMYADMIN_PRIVATE_DIR}/config.inc.php"
 SIGNON_SCRIPT="${PHPMYADMIN_PRIVATE_DIR}/da_signon.php"
 SIGNON_URL_PAGE="${PHPMYADMIN_PRIVATE_DIR}/da_login.php"
 BLOWFISH_SECRET_FILE="${RUNTIME_DIR}/blowfish_secret"
+APACHE_HTTPD_CONF="${APACHE_HTTPD_CONF:-/etc/httpd/conf/httpd.conf}"
+APACHE_VHOSTS_CONF="${APACHE_VHOSTS_CONF:-/etc/httpd/conf/extra/httpd-vhosts.conf}"
 CUSTOMBUILD_DIR="${CUSTOMBUILD_DIR:-/usr/local/directadmin/custombuild}"
 CB_BUILD="${CUSTOMBUILD_DIR}/build"
 APACHE_ALIAS_CUSTOM="${CUSTOMBUILD_DIR}/custom/ap2/conf/extra/httpd-alias.conf"
@@ -57,8 +59,18 @@ chmod_or_warn() {
 detect_apache_group() {
     local group_name=""
 
-    if [ -f /etc/httpd/conf/httpd.conf ]; then
-        group_name="$(awk 'tolower($1)=="group" {print $2; exit}' /etc/httpd/conf/httpd.conf | tr -d '[:space:]')"
+    # Under SuExec (DirectAdmin's own convention for the default/shared
+    # vhost that serves /var/www/html), PHP actually executes as the
+    # SuexecUserGroup account (commonly "webapps"), not as Apache's own
+    # httpd.conf "Group" (commonly "apache"). That distinction is exactly
+    # what determines whether phpMyAdmin's SSO ticket files are readable,
+    # so it takes priority over the plain Group directive below.
+    if [ -f "$APACHE_VHOSTS_CONF" ]; then
+        group_name="$(awk 'tolower($1)=="suexecusergroup" {print $3; exit}' "$APACHE_VHOSTS_CONF" | tr -d '[:space:]')"
+    fi
+
+    if [ -z "$group_name" ] && [ -f "$APACHE_HTTPD_CONF" ]; then
+        group_name="$(awk 'tolower($1)=="group" {print $2; exit}' "$APACHE_HTTPD_CONF" | tr -d '[:space:]')"
     fi
 
     if [ -z "$group_name" ] && [ -f /etc/apache2/apache2.conf ]; then
diff --git a/tests/package_archive_test.sh b/tests/package_archive_test.sh
index 0989593..32a0c76 100644
--- a/tests/package_archive_test.sh
+++ b/tests/package_archive_test.sh
@@ -2,7 +2,7 @@
 set -euo pipefail
 
 PLUGIN_DIR="$(cd "$(dirname "$0")/.." && pwd)"
-ARCHIVE="${1:-$(cd "$PLUGIN_DIR/.." && pwd)/archives/1.2.12/alt-mysql.tar.gz}"
+ARCHIVE="${1:-$(cd "$PLUGIN_DIR/.." && pwd)/archives/1.2.13/alt-mysql.tar.gz}"
 
 fail() {
   echo "FAIL: $*" >&2
@@ -37,7 +37,7 @@ fi
 CONF="$(tar -xOzf "$ARCHIVE" ./plugin.conf 2>/dev/null || tar -xOzf "$ARCHIVE" plugin.conf)"
 printf '%s\n' "$CONF" | grep -Fxq "name=alt-mysql" || fail "archive plugin name is not alt-mysql"
 printf '%s\n' "$CONF" | grep -Fxq "id=alt-mysql" || fail "archive plugin id is not alt-mysql"
-printf '%s\n' "$CONF" | grep -Fxq "version=1.2.12" || fail "archive plugin version is not 1.2.12"
+printf '%s\n' "$CONF" | grep -Fxq "version=1.2.13" || fail "archive plugin version is not 1.2.13"
 
 SETTINGS="$(tar -xOzf "$ARCHIVE" ./plugin-settings.conf 2>/dev/null || tar -xOzf "$ARCHIVE" plugin-settings.conf)"
 printf '%s\n' "$SETTINGS" | grep -Fxq "PHPMYADMIN_INSTALL_DIR=/var/www/html/alt-mysql-phpmyadmin" \
diff --git a/tests/phpmyadmin_install_test.sh b/tests/phpmyadmin_install_test.sh
index 0e24e7e..55a112b 100644
--- a/tests/phpmyadmin_install_test.sh
+++ b/tests/phpmyadmin_install_test.sh
@@ -59,6 +59,38 @@ bash "$SCRIPT" >/dev/null
 BEGIN_COUNT="$(grep -Fc "# BEGIN ALT_MYSQL_PHPMYADMIN" "$ALIAS_CONF" || true)"
 [ "$BEGIN_COUNT" -eq 1 ] || fail "Apache alias block was duplicated on re-run (found $BEGIN_COUNT times)"
 
+# Under SuExec (DirectAdmin's default vhost convention), PHP for the shared
+# /var/www/html vhost executes as the SuexecUserGroup account (e.g. "webapps"),
+# not as Apache's own httpd.conf "Group" (e.g. "apache"). Ticket files must be
+# group-owned by whichever account actually executes PHP there, or phpMyAdmin's
+# da_login.php cannot read them.
+FAKE_HTTPD_CONF="$TMP_DIR/httpd.conf"
+cat > "$FAKE_HTTPD_CONF" <<'EOF'
+User apache
+Group apache
+EOF
+FAKE_VHOSTS_CONF="$TMP_DIR/httpd-vhosts.conf"
+cat > "$FAKE_VHOSTS_CONF" <<'EOF'
+<VirtualHost 127.0.0.1:80>
+    DocumentRoot /var/www/html
+    SuexecUserGroup webapps webapps
+</VirtualHost>
+EOF
+
+SUEXEC_CUSTOMBUILD_DIR="$TMP_DIR/custombuild-suexec"
+mkdir -p "$SUEXEC_CUSTOMBUILD_DIR"
+SUEXEC_STDERR="$TMP_DIR/suexec-install.stderr"
+PHPMYADMIN_PRIVATE_DIR="$TMP_DIR/alt-mysql-phpmyadmin-suexec" \
+PHPMYADMIN_SOURCE_DIR="$TMP_DIR/phpMyAdmin-source" \
+PHPMYADMIN_INSTALL_ASSUME_ROOT=1 \
+CUSTOMBUILD_DIR="$SUEXEC_CUSTOMBUILD_DIR" \
+APACHE_HTTPD_CONF="$FAKE_HTTPD_CONF" \
+APACHE_VHOSTS_CONF="$FAKE_VHOSTS_CONF" \
+bash "$SCRIPT" >/dev/null 2>"$SUEXEC_STDERR"
+
+grep -Fq "diradmin:webapps" "$SUEXEC_STDERR" \
+  || fail "phpMyAdmin installer must chown the runtime/tickets dirs to the SuexecUserGroup account (webapps), not Apache's own Group (apache). stderr was: $(cat "$SUEXEC_STDERR")"
+
 SERVER_JSON="$(php -r '
   $_SERVER["HTTPS"] = "on";
   $_SERVER["HTTP_HOST"] = "panel.example.test";
diff --git a/tests/plugin_identity_test.sh b/tests/plugin_identity_test.sh
index 4decc49..236d500 100644
--- a/tests/plugin_identity_test.sh
+++ b/tests/plugin_identity_test.sh
@@ -14,7 +14,7 @@ case "$(basename "$PLUGIN_DIR")" in
 esac
 grep -Fxq "name=alt-mysql" "$PLUGIN_DIR/plugin.conf" || fail "plugin.conf name is not alt-mysql"
 grep -Fxq "id=alt-mysql" "$PLUGIN_DIR/plugin.conf" || fail "plugin.conf id is not alt-mysql"
-grep -Fxq "version=1.2.12" "$PLUGIN_DIR/plugin.conf" || fail "plugin.conf version is not 1.2.12"
+grep -Fxq "version=1.2.13" "$PLUGIN_DIR/plugin.conf" || fail "plugin.conf version is not 1.2.13"
 grep -Fq "return '/CMD_PLUGINS/alt-mysql';" "$PLUGIN_DIR/exec/lib/AppContext.php" \
   || fail "AppContext base URL is not alt-mysql"
 grep -Fq "\$pluginId = 'alt-mysql';" "$PLUGIN_DIR/exec/lib/DirectAdminUser.php" \