diff --git a/kubernetes/apps/libation/cronjob.yaml b/kubernetes/apps/libation/cronjob.yaml
index ca918491..dca6c762 100644
--- a/kubernetes/apps/libation/cronjob.yaml
+++ b/kubernetes/apps/libation/cronjob.yaml
@@ -50,14 +50,22 @@ spec:
               command: ["/bin/sh", "-eu", "-c"]
               args:
                 - |
+                  # `install -m 660` sets read+write for owner and group on
+                  # each file. The bootstrap Secret mount is read-only
+                  # (defaultMode: 0400), so a plain `cp` would propagate
+                  # 0400 and LibationCli's SQLite migrations would fail
+                  # with "cannot write database". fsGroup 1000 on the pod
+                  # gives every container gid 1000, so 0660 + gid 1000 is
+                  # enough for both the init copy and the main libation
+                  # process to read and write the files.
                   if [ -f /libation-state/.bootstrapped ]; then
                     echo "libation-config already bootstrapped; skipping seed"
                     exit 0
                   fi
                   echo "seeding libation-config from bootstrap secret"
-                  cp /bootstrap/AccountsSettings.json /libation-state/AccountsSettings.json
-                  cp /bootstrap/Settings.json          /libation-state/Settings.json
-                  cp /bootstrap/LibationContext.db     /libation-state/LibationContext.db
+                  install -m 660 /bootstrap/AccountsSettings.json /libation-state/AccountsSettings.json
+                  install -m 660 /bootstrap/Settings.json          /libation-state/Settings.json
+                  install -m 660 /bootstrap/LibationContext.db     /libation-state/LibationContext.db
                   touch /libation-state/.bootstrapped
                   ls -la /libation-state
               volumeMounts: