diff --git a/roles/searxng/defaults/main.yml b/roles/searxng/defaults/main.yml
index 774e6ca..96282b9 100644
--- a/roles/searxng/defaults/main.yml
+++ b/roles/searxng/defaults/main.yml
@@ -13,7 +13,8 @@ searxng_container_port: 8080
 searxng_base_url: "http://{{ ansible_host }}:{{ searxng_host_port }}/"
 
 # Override via host_vars or vault; must be stable across restarts.
-searxng_secret_key: "CHANGE_ME_SEARXNG_SECRET"
+# SearxNG expects a long random string (use >= 32 chars).
+searxng_secret_key: "change-me-searxng-secret-key-32chars"
 
 # LAN CIDR allowed to hit the JSON API (same pattern as observability).
 searxng_ufw_from: "{{ ufw_ssh_allowed_network }}"
diff --git a/roles/searxng/tasks/main.yml b/roles/searxng/tasks/main.yml
index 83b2460..45a8753 100644
--- a/roles/searxng/tasks/main.yml
+++ b/roles/searxng/tasks/main.yml
@@ -8,7 +8,7 @@
     state: directory
     owner: "{{ admin_user }}"
     group: "{{ admin_user }}"
-    mode: "0750"
+    mode: "0755"
 
 - name: searxng | settings.yml
   ansible.builtin.template:
@@ -16,7 +16,8 @@
     dest: "{{ searxng_dir }}/settings.yml"
     owner: "{{ admin_user }}"
     group: "{{ admin_user }}"
-    mode: "0640"
+    # Container runs as non-root searxng UID — must be world-readable (#10).
+    mode: "0644"
   register: _searxng_settings
 
 - name: searxng | compose file