diff --git a/services/cassandra/kustomization.yaml b/services/cassandra/kustomization.yaml
index 3679f1a1b..d289ba673 100644
--- a/services/cassandra/kustomization.yaml
+++ b/services/cassandra/kustomization.yaml
@@ -24,3 +24,4 @@ resources:
   - bootstrap-jobs/cassandra-secrets-ensure-job.yaml
   - migration-jobs/db-copy-veles-to-cassandra-job.yaml
   - migration-jobs/artifact-copy-veles-to-cassandra-job.yaml
+  - migration-jobs/artifact-permissions-job.yaml
diff --git a/services/cassandra/migration-jobs/artifact-permissions-job.yaml b/services/cassandra/migration-jobs/artifact-permissions-job.yaml
new file mode 100644
index 000000000..fd7fda72a
--- /dev/null
+++ b/services/cassandra/migration-jobs/artifact-permissions-job.yaml
@@ -0,0 +1,42 @@
+# services/cassandra/migration-jobs/artifact-permissions-job.yaml
+# One-off migration repair after copying artifacts from the Veles PVC.
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: cassandra-artifact-permissions-1
+  namespace: cassandra
+spec:
+  suspend: false
+  backoffLimit: 0
+  ttlSecondsAfterFinished: 86400
+  template:
+    spec:
+      serviceAccountName: cassandra-artifact-migration
+      automountServiceAccountToken: false
+      restartPolicy: Never
+      nodeSelector:
+        cassandra.bstein.dev/node-pool: oceanus
+      tolerations:
+        - key: veles.bstein.dev/simulation
+          operator: Equal
+          value: "true"
+          effect: NoSchedule
+      containers:
+        - name: permissions
+          image: alpine:3.20
+          imagePullPolicy: IfNotPresent
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              set -eu
+              chown -R 10001:10001 /data/cassandra-artifacts
+              find /data/cassandra-artifacts -type d -exec chmod 2775 {} +
+              find /data/cassandra-artifacts -type f -exec chmod 0664 {} +
+              printf 'artifact permission repair complete\n'
+          volumeMounts:
+            - name: artifacts
+              mountPath: /data/cassandra-artifacts
+      volumes:
+        - name: artifacts
+          persistentVolumeClaim:
+            claimName: cassandra-artifacts