diff --git a/auth/apikey.go b/auth/apikey.go
index 77e48c9..da200be 100644
--- a/auth/apikey.go
+++ b/auth/apikey.go
@@ -166,7 +166,12 @@ func (s *KeyStore) saveLocked() error {
 		return err
 	}
 	tmp := s.path + ".tmp"
-	if err := os.WriteFile(tmp, raw, 0o600); err != nil {
+	// 0644, not 0600: the store holds only SHA-256 hashes + metadata (no
+	// plaintext keys) and is read by OTHER services in their own containers
+	// (they run as different, non-root uids), so the written file must be
+	// world-readable. A 0600 file owned by the writing pod's uid would go
+	// unreadable to them and freeze their ReloadIfChanged snapshots.
+	if err := os.WriteFile(tmp, raw, 0o644); err != nil {
 		return err
 	}
 	return os.Rename(tmp, s.path)