diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index d977312..49ae56a 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -234,6 +234,11 @@ func TestLoadAcceptsSystemdCredentialReadPermissions(t *testing.T) {
 	if err := os.WriteFile(profiles, []byte(content), 0444); err != nil {
 		t.Fatal(err)
 	}
+	// os.WriteFile applies the process umask, so restore the read-only
+	// credential permissions the systemd credential directory really uses.
+	if err := os.Chmod(profiles, 0444); err != nil {
+		t.Fatal(err)
+	}
 	t.Setenv("CREDENTIALS_DIRECTORY", credentials)
 	server := `{"public_hostname":"proxy.example.com","public_dir":"public","profiles_file":"credentials/profiles.json"}`
 	path := filepath.Join(directory, "config.json")