diff --git a/CHANGELOG.md b/CHANGELOG.md
index 91b85b4..0796f11 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,10 @@ Please choose versions by [Semantic Versioning](http://semver.org/).
 * MINOR version when you add functionality in a backwards-compatible manner, and
 * PATCH version when you make backwards-compatible bug fixes.
 
+## Unreleased
+
+- helm: harden mTLS cert volume `defaultMode` `420` (0644) → `288` (0440) — drops world-read on the mounted client key while keeping group-read so a non-root pod (`runAsUser`+`fsGroup`) can still read it (`0400` would deny it). Chart 0.4.0 → 0.4.1. Matches the `bborbe/maintainer` chart fix.
+
 ## v0.76.0
 
 - helm: optional mTLS Kafka support (default off) for executor, controllers, and recurring-task-creator. When `<component>.kafkaUser.enabled: true` the chart emits a Strimzi `KafkaUser` CR (`type: tls`) in `strimziNamespace` AND mounts the client cert/key + cluster CA at the fixed `/client-cert/file`, `/client-key/file`, `/server-cert/file` paths that `github.com/bborbe/kafka` reads for `tls://` brokers. New per-component values `kafkaUser.{userName,clientSecret,caCertSecret}` (secrets referenced by name only — Strimzi issues them, an external syncer places them in the app namespace). Default renders byte-identical to before → plaintext clusters (quant) unaffected. Adds executor + controller `KafkaUser` templates and the cert mount recurring-task-creator previously lacked. Chart 0.3.1 → 0.4.0. Unblocks the Octopus per-stage-Strimzi (mTLS) deploy.
diff --git a/helm/Chart.yaml b/helm/Chart.yaml
index a18461c..7b3f1e3 100644
--- a/helm/Chart.yaml
+++ b/helm/Chart.yaml
@@ -3,7 +3,7 @@ name: agent
 description: bborbe agent framework — event-driven, Kafka-based, K8s-native task platform (controller, executor, and example agents)
 type: application
 # Chart version — bumped on chart changes, independent of appVersion.
-version: 0.4.0
+version: 0.4.1
 # Default image tag for the framework components when values don't override.
 appVersion: "0.3.1"
 home: https://github.com/bborbe/agent
diff --git a/helm/templates/_helpers.tpl b/helm/templates/_helpers.tpl
index 7f34b13..7d114a6 100644
--- a/helm/templates/_helpers.tpl
+++ b/helm/templates/_helpers.tpl
@@ -44,21 +44,23 @@ helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" }}
 {{- define "agent.kafkaCertVolumes" -}}
 - name: client-cert
   secret:
-    defaultMode: 420
+    # 0440 (octal): owner+group read, no world read. Files are owned root:fsGroup,
+    # so a non-root pod (runAsUser+fsGroup) reads via group; 0400 would deny it.
+    defaultMode: 288
     secretName: {{ .clientSecret }}
     items:
       - key: user.crt
         path: file
 - name: client-key
   secret:
-    defaultMode: 420
+    defaultMode: 288
     secretName: {{ .clientSecret }}
     items:
       - key: user.key
         path: file
 - name: server-cert
   secret:
-    defaultMode: 420
+    defaultMode: 288
     secretName: {{ .caCertSecret }}
     items:
       - key: ca.crt