diff --git a/hive-c0re/src/matrix.rs b/hive-c0re/src/matrix.rs
index 35fb0958..678e9707 100644
--- a/hive-c0re/src/matrix.rs
+++ b/hive-c0re/src/matrix.rs
@@ -99,13 +99,7 @@ pub fn ensure_register_token() -> Result<String> {
     }
     std::fs::write(path, format!("{token}\n"))
         .with_context(|| format!("write registration token to {}", path.display()))?;
-    // Mode 0640 (group-readable for tuwunel via the host-side
-    // activation script's chown). 0600 blocks tuwunel; 0644
-    // world-reads the token. The activation script reconciles
-    // chown + chmod on every boot, so this write is best-effort.
-    // See `docs/matrix.md::Provisioning flow (registration token)`
-    // for the host/container permission split.
-    let _ = std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o640));
+    let _ = std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o600));
     tracing::info!(path = %path.display(), "matrix: generated registration token");
     Ok(token)
 }