diff --git a/internal/config/instance_settings_test.go b/internal/config/instance_settings_test.go
index bae7866c..211b10e1 100644
--- a/internal/config/instance_settings_test.go
+++ b/internal/config/instance_settings_test.go
@@ -72,7 +72,8 @@ func TestInstanceSettingsPermissiveFileRejected(t *testing.T) {
 	root := t.TempDir()
 	t.Setenv("CONFIG_ROOT", root)
 	p := filepath.Join(root, "instance-settings.json")
-	_ = os.WriteFile(p, []byte(`{"settings":{"http_port":9000}}`), 0o666)
+	_ = os.WriteFile(p, []byte(`{"settings":{"http_port":9000}}`), 0o600)
+	_ = os.Chmod(p, 0o666) // 显式置位：WriteFile 的 mode 受 umask 侵蚀（CI 022 下 0666→0644）
 	if _, err := Load(""); err == nil {
 		t.Fatal("group/world writable instance settings must be rejected")
 	}