diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index edd870b..460e3a7 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -81,7 +81,8 @@ jobs:
           $SUDO ln -sfn "$RELEASE_DIR" "$APP_ROOT/current"
 
           printf '%s' "$STUDIO_PASSWORD" | $SUDO tee /etc/rednote-tool-studio.password >/dev/null
-          $SUDO chmod 600 /etc/rednote-tool-studio.password
+          $SUDO chown root:"$SERVICE_USER" /etc/rednote-tool-studio.password
+          $SUDO chmod 640 /etc/rednote-tool-studio.password
 
           cat > rednote-tool-studio.service <<EOF
           [Unit]