diff --git a/nix/vm-tests/swarm-archive.nix b/nix/vm-tests/swarm-archive.nix
index 7d142a428..8f7320ec0 100644
--- a/nix/vm-tests/swarm-archive.nix
+++ b/nix/vm-tests/swarm-archive.nix
@@ -31,7 +31,11 @@ let
   agentRoot = "/var/lib/hyperhive/agents";
 
   # A directory is a leaf, a file in it a field: `kv get -field=<f> <path>`.
+  # The store stays readable by every caller whatever the umask of the writer:
+  # the users unit runs with `UMask=0027` and its `kv put` creates the parent
+  # directories, which the prune (another user) must still traverse.
   fakeBao = pkgs.writeShellScriptBin "bao" ''
+    umask 022
     store=${store}
     case "$1 $2" in
       "login -method=cert") echo faketoken; exit 0 ;;