diff --git a/pkg/identity/identity_test.go b/pkg/identity/identity_test.go
index 81a238f..3b00cdb 100644
--- a/pkg/identity/identity_test.go
+++ b/pkg/identity/identity_test.go
@@ -137,6 +137,9 @@ func TestDSNFileMode(t *testing.T) {
 	if err := os.WriteFile(good, []byte("postgres://example\n"), 0o600); err != nil {
 		t.Fatal(err)
 	}
+	if err := os.Chmod(good, 0o600); err != nil {
+		t.Fatal(err)
+	}
 	got, err := ResolveDSN("", good)
 	if err != nil || got != "postgres://example" {
 		t.Fatalf("0600 文件：%q %v", got, err)
@@ -145,6 +148,9 @@ func TestDSNFileMode(t *testing.T) {
 	if err := os.WriteFile(loose, []byte("postgres://x"), 0o644); err != nil {
 		t.Fatal(err)
 	}
+	if err := os.Chmod(loose, 0o644); err != nil {
+		t.Fatal(err)
+	}
 	if _, err := ResolveDSN("", loose); err == nil {
 		t.Fatal("0644 的 dsn 文件必须拒绝")
 	}