diff --git a/install.sh b/install.sh
index c1432cd..2125025 100755
--- a/install.sh
+++ b/install.sh
@@ -125,6 +125,9 @@ install_nvidia() {
   log "NVIDIA Container Toolkit installieren"
   curl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey | \
     gpg --dearmor --yes -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg
+  # apt verifies repository metadata as the unprivileged _apt user. The
+  # installer's restrictive umask would otherwise leave this keyring at 0600.
+  chmod 0644 /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg
   curl -fsSL https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list | \
     sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' \
     >/etc/apt/sources.list.d/nvidia-container-toolkit.list