diff --git a/migrations/013-install-pgbouncer.sh b/migrations/013-install-pgbouncer.sh
index c3b1415..480dcb9 100644
--- a/migrations/013-install-pgbouncer.sh
+++ b/migrations/013-install-pgbouncer.sh
@@ -27,7 +27,9 @@ USERLIST=/etc/pgbouncer/userlist.txt
 LOG=/var/log/postgresql/pgbouncer.log
 
 write_ini() {
-  install -d -o postgres -g postgres -m 750 /etc/pgbouncer
+  # dir 755 + ini 644 so non-root `sysmig status` can verify; the only
+  # sensitive file is userlist.txt (SCRAM verifiers) - stays 640 postgres
+  install -d -m 755 /etc/pgbouncer
   cat > "$INI" <<'EOF'
 ;; managed by sysmig 013-install-pgbouncer - serverless connection pooler
 [databases]
@@ -65,7 +67,7 @@ pidfile = /var/run/postgresql/pgbouncer.pid
 user = postgres
 EOF
   chown postgres:postgres "$INI"
-  chmod 640 "$INI"
+  chmod 644 "$INI"
 }
 
 case "${1:-}" in