diff --git a/internal/customerauth/store.go b/internal/customerauth/store.go
index 3910e86..10bb0d6 100644
--- a/internal/customerauth/store.go
+++ b/internal/customerauth/store.go
@@ -174,6 +174,11 @@ func (s *CredentialStore) persistLocked() error {
 		return fmt.Errorf("customerauth: temp file: %w", err)
 	}
 	tmpName := tmp.Name()
+	if err := tmp.Chmod(0644); err != nil {
+		tmp.Close()
+		os.Remove(tmpName)
+		return fmt.Errorf("customerauth: chmod temp: %w", err)
+	}
 	if _, err := tmp.Write(data); err != nil {
 		tmp.Close()
 		os.Remove(tmpName)
diff --git a/pkg/promotions/store.go b/pkg/promotions/store.go
index e2d0c17..976f223 100644
--- a/pkg/promotions/store.go
+++ b/pkg/promotions/store.go
@@ -128,6 +128,10 @@ func (s *Store) saveLocked() error {
 	}
 	tmpName := tmp.Name()
 	defer os.Remove(tmpName) // no-op once renamed
+	if err := tmp.Chmod(0644); err != nil {
+		tmp.Close()
+		return err
+	}
 	if _, err := tmp.Write(data); err != nil {
 		tmp.Close()
 		return err