diff --git a/scripts/backup-online.sh b/scripts/backup-online.sh
index 4ff4714..d059599 100755
--- a/scripts/backup-online.sh
+++ b/scripts/backup-online.sh
@@ -71,7 +71,9 @@ user=${backup_user}
 password=${backup_password}
 host=mysql
 EOF
-  chmod 600 "${tmp_dir}/xtrabackup-client.cnf"
+  # XtraBackup 镜像可能以非 root 用户运行；临时目录受 umask 077 保护，
+  # 因此配置文件需要对容器内用户可读，但不会暴露给宿主机其他用户。
+  chmod 644 "${tmp_dir}/xtrabackup-client.cnf"
 
   backup_log "开始全量热备，实例 ${server_uuid}"
   docker run --rm \