diff --git a/platform/proxmox/ansible/roles/infra-stack/tasks/main.yml b/platform/proxmox/ansible/roles/infra-stack/tasks/main.yml
index 1fbb3a9..91227dd 100644
--- a/platform/proxmox/ansible/roles/infra-stack/tasks/main.yml
+++ b/platform/proxmox/ansible/roles/infra-stack/tasks/main.yml
@@ -25,6 +25,8 @@
     dest: "{{ infra_repo_dir }}/"
     delete: true
     rsync_opts:
+      # Der Clone auf ops ist teils 0600/0700; Container-Benutzer (nobody, grafana, knaster) müssen lesen können
+      - "--chmod=go+rX,go-w"
       - "--exclude=__pycache__"
       - "--exclude=.pytest_cache"
       - "--exclude=*.egg-info"