diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index f3116b6..a6875d2 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -183,6 +183,15 @@ jobs:
               echo "docker group: adding $USER"
               sudo usermod -aG docker "$USER"
             fi
+            # docker compose reads env_file client-side as this user, so the
+            # root-managed DB secret must be group-readable by the deploy user.
+            MYSQL_ENV=/opt/webapps/webapp-mysql.env
+            if [ -f "$MYSQL_ENV" ] && ! [ -r "$MYSQL_ENV" ]; then
+              echo "mysql env: granting docker-group read"
+              sudo chgrp docker "$MYSQL_ENV" && sudo chmod 640 "$MYSQL_ENV"
+            else
+              echo "mysql env: readable (or absent)"
+            fi
           '
           # Prove a NEW session can reach the docker daemon before streaming ~GBs.
           ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no $WEB_VPS \