diff --git a/docker/scripts/1-ensure-cert.sh b/docker/scripts/1-ensure-cert.sh
index 9b67692..52f48c2 100644
--- a/docker/scripts/1-ensure-cert.sh
+++ b/docker/scripts/1-ensure-cert.sh
@@ -31,6 +31,15 @@ if [ ! -f /etc/certificates/site.pem ]; then
       -keyout site.key.tmp -out site.crt.tmp
     cat site.key.tmp site.crt.tmp > site.pem.tmp
     rm -f site.key.tmp site.crt.tmp
+    # Readable by HAProxy, which runs unprivileged (uid 1001) and opens this
+    # file while parsing `bind ... ssl crt`. Under the umask above the
+    # placeholder came out 0600 root-only, HAProxy could not start at all, and
+    # the pass then waited forever for a runtime API socket that no longer had
+    # anyone to create it — a failed issuance took the whole site down instead
+    # of leaving it on the placeholder. The real certificate has been 0644 all
+    # along: 2-concatenate-cert.sh writes it with the default umask. Set on the
+    # temporary file, so the rename below stays the only thing HAProxy can see.
+    chmod 644 site.pem.tmp
     # Last and atomic: HAProxy reads site.pem at start-up and must never find
     # it half-written.
     mv site.pem.tmp site.pem