diff --git a/src/scripts/update-semester-data.js b/src/scripts/update-semester-data.js
index f4d39de..e0994e6 100644
--- a/src/scripts/update-semester-data.js
+++ b/src/scripts/update-semester-data.js
@@ -256,7 +256,12 @@ function atomicWriteFileSync(filePath, content) {
     }
 
     const tmpPath = `${resolvedPath}.tmp.${Date.now()}`
-    fs.writeFileSync(tmpPath, content, 'utf8')
+    fs.writeFileSync(tmpPath, content, { encoding: 'utf8', mode: 0o644 })
+    try {
+        fs.chmodSync(tmpPath, 0o644)
+    } catch {
+        // Ignore chmod errors if not supported or not owner
+    }
     fs.renameSync(tmpPath, resolvedPath)
 }
 
diff --git a/systemd/orario-update.service b/systemd/orario-update.service
index 45a3182..0c79ab9 100644
--- a/systemd/orario-update.service
+++ b/systemd/orario-update.service
@@ -5,10 +5,13 @@ Wants=network-online.target
 
 [Service]
 Type=oneshot
-# Adjust user/paths if needed for your server environment:
-User=caddy
-Group=caddy
-WorkingDirectory=/var/www/orario
-ExecStart=/usr/bin/node /var/www/orario/scripts/update-semester-data.js --output /var/www/orario/semester-data.json --quiet
+# NOTE: If your webroot (e.g. orario.volume) is created by Docker (owned by root:root),
+# run this service as root by leaving User/Group unset (or User=root).
+# The script automatically writes files with world-readable 0644 permissions so Caddy can read them.
+# If you prefer running as caddy, ensure 'chown -R caddy:caddy <webroot>' is run after docker builds.
+# User=caddy
+# Group=caddy
+WorkingDirectory=/srv/services/orario
+ExecStart=/usr/bin/node /srv/services/orario/src/scripts/update-semester-data.js --output /srv/services/orario/orario.volume/semester-data.json --quiet
 StandardOutput=journal
 StandardError=journal