diff --git a/services/gitea/atlas-identity-bootstrap-job.yaml b/services/gitea/atlas-identity-bootstrap-job.yaml
index d452bc883..3402ba038 100644
--- a/services/gitea/atlas-identity-bootstrap-job.yaml
+++ b/services/gitea/atlas-identity-bootstrap-job.yaml
@@ -17,11 +17,11 @@ spec:
     spec:
       restartPolicy: Never
       serviceAccountName: gitea-vault
+      # fsGroup would recursively loosen Gitea's OpenSSH key permissions on this shared PVC.
       securityContext:
         runAsNonRoot: true
         runAsUser: 1000
         runAsGroup: 1000
-        fsGroup: 1000
         seccompProfile:
           type: RuntimeDefault
       affinity: