diff --git a/crates/sponsord/CHANGELOG.md b/crates/sponsord/CHANGELOG.md
index ab4ffa7..4bd7611 100644
--- a/crates/sponsord/CHANGELOG.md
+++ b/crates/sponsord/CHANGELOG.md
@@ -40,3 +40,14 @@ release.
   `github.com/decdn/decdn`, at the commit `Cargo.lock` pins
   (`7f938e6b8437eba614e54375dcbc504de108379d`); `decdn.ref` and the sibling
   checkout are gone.
+
+### Fixed
+
+- **Keystore credential in the systemd unit.**
+  `deploy/systemd/sponsord.service` copies the keystore credential to a `0600`
+  file under `/run/sponsord` before start. Some systemd versions (254+ on
+  Linux 6.4+, seen on 255) load credentials at `0440`, which the daemon
+  refused as an insecure keystore
+  ([#36](https://github.com/decdn/sponsord/issues/36)). If you installed a copy
+  of the unit, take its new `RuntimeDirectory=`, `RuntimeDirectoryMode=`,
+  `ExecStartPre=` and `SPONSORD_TREASURY_KEYSTORE` lines.
diff --git a/deploy/systemd/sponsord.service b/deploy/systemd/sponsord.service
index 4a9a17d..454e3e0 100644
--- a/deploy/systemd/sponsord.service
+++ b/deploy/systemd/sponsord.service
@@ -17,7 +17,15 @@ LoadCredential=treasury-password:/etc/sponsord/treasury-password
 LoadCredential=treasury-keystore.json:/etc/sponsord/treasury-keystore.json
 Environment=SPONSORD_API_TOKEN_FILE=%d/api-token
 Environment=SPONSORD_TREASURY_PASSWORD_FILE=%d/treasury-password
-Environment=SPONSORD_TREASURY_KEYSTORE=%d/treasury-keystore.json
+# Some systemd versions (254+ on Linux 6.4+, seen on 255) load credentials at
+# mode 0440, and the daemon refuses a keystore with any group or other bit
+# set. So copy it to a private 0600 file first. The copy is still the
+# encrypted keystore, the password stays in %d, and systemd removes
+# /run/sponsord when the service stops.
+RuntimeDirectory=sponsord
+RuntimeDirectoryMode=0700
+ExecStartPre=/usr/bin/install -m 0600 %d/treasury-keystore.json %t/sponsord/treasury-keystore.json
+Environment=SPONSORD_TREASURY_KEYSTORE=%t/sponsord/treasury-keystore.json
 DynamicUser=yes
 Restart=on-failure
 RestartSec=5s
diff --git a/docs/operator.md b/docs/operator.md
index efa4c3e..97fb0ea 100644
--- a/docs/operator.md
+++ b/docs/operator.md
@@ -118,7 +118,10 @@ For a different kind of check, see [integrator.md](integrator.md).
   source with `docker compose build`
   ([`deploy/Dockerfile`](../deploy/Dockerfile)).
 - **systemd:** [`deploy/systemd/`](../deploy/systemd) has a unit for each,
-  with secrets as `LoadCredential=` credentials.
+  with secrets as `LoadCredential=` credentials (systemd 252 or later). Some
+  systemd versions load credentials at mode `0440`, which the daemon refuses
+  for a keystore. So the daemon's unit copies the keystore to a `0600` file
+  under `/run/sponsord` before start.
 - **Release binaries:** each `sponsord-vX.Y.Z` and `sponsord-onramp-vX.Y.Z`
   GitHub Release has its binary for Linux x86_64 and aarch64, with a signed
   `SHA256SUMS`.