diff --git a/platform/keycloak/client-secret-reconciler.yaml b/platform/keycloak/client-secret-reconciler.yaml
index 5047110..0d231d7 100644
--- a/platform/keycloak/client-secret-reconciler.yaml
+++ b/platform/keycloak/client-secret-reconciler.yaml
@@ -649,6 +649,12 @@ spec:
             runAsNonRoot: true
             runAsUser: 65532
             runAsGroup: 65532
+            # fsGroup makes the projected Secret volume GROUP-owned by 65532. Without it the
+            # files are owned by root and mode 0400 (owner-only) is unreadable to runAsUser
+            # 65532 — the container died with "cannot read /etc/keycloak-realm-clients
+            # (PermissionError)" on every run. fsGroup + 0440 keeps the secret unreadable to
+            # other users rather than relaxing it to world-readable 0444.
+            fsGroup: 65532
             seccompProfile:
               type: RuntimeDefault
           containers:
@@ -717,4 +723,7 @@ spec:
             - name: client-secrets
               secret:
                 secretName: keycloak-realm-clients
-                defaultMode: 0400
+                # 0440 (not 0400): readable by fsGroup 65532, which the pod securityContext
+                # sets. 0400 is owner-only and the owner is root, not the 65532 the container
+                # runs as. See the fsGroup comment above.
+                defaultMode: 0440