diff --git a/scripts/setup-node-ca.sh b/scripts/setup-node-ca.sh
index 727d4f19..b74f07b9 100755
--- a/scripts/setup-node-ca.sh
+++ b/scripts/setup-node-ca.sh
@@ -127,6 +127,27 @@ openssl x509 -req -in "$TMP/leaf.csr" -CA "$CA_CRT" -CAkey "$CA_KEY" \
 install -m 644 "$TMP/leaf.crt" "$LEAF_CRT"
 install -m 600 "$TMP/leaf.key" "$LEAF_KEY"
 
+# The leaf key has TWO readers with different privileges: nginx's master
+# process (root) and the archipelago daemon (User=archipelago), which needs it
+# to terminate TLS on gated app ports. Root-only 0600 silently costs the daemon
+# its TLS — it logs "Permission denied" and every app port quietly stays plain
+# HTTP, which is exactly the fail-open shape the gate is built to avoid. So the
+# key is group-readable by the service user and nothing wider.
+SERVICE_USER="${ARCHY_SERVICE_USER:-archipelago}"
+if getent group "$SERVICE_USER" >/dev/null 2>&1; then
+  chgrp "$SERVICE_USER" "$LEAF_KEY" && chmod 640 "$LEAF_KEY"
+  log "Key readable by group $SERVICE_USER (0640) — the daemon needs it for app-port TLS"
+elif getent passwd "$SERVICE_USER" >/dev/null 2>&1; then
+  # User exists without an eponymous group — fall back to its primary group.
+  PRIMARY="$(id -gn "$SERVICE_USER" 2>/dev/null || true)"
+  if [ -n "$PRIMARY" ]; then
+    chgrp "$PRIMARY" "$LEAF_KEY" && chmod 640 "$LEAF_KEY"
+    log "Key readable by group $PRIMARY (0640)"
+  fi
+else
+  log "No '$SERVICE_USER' user on this host — key left root-only (0600)"
+fi
+
 # The dashboard serves this for download; it is a public certificate, never the key.
 install -m 644 "$CA_CRT" "$SSL_DIR/ca-download.crt"