diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 57bfbbf..2646ded 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -64,7 +64,7 @@ jobs:
               env = directory / '.env'
               values = [line.partition('=')[2] for line in env.read_text().splitlines()
                         if re.search(r'PASSWORD|SECRET|KEY|COOKIE', line.partition('=')[0])] if env.exists() else []
-              for name in ('build.log', 'start.log', 'ready.log'):
+              for name in ('build.log', 'start.log', 'ready.log', 'services.log'):
                   path = directory / name
                   if not path.exists():
                       continue
diff --git a/deploy/self-hosted/smoke.sh b/deploy/self-hosted/smoke.sh
index 3935ebd..a02fb86 100755
--- a/deploy/self-hosted/smoke.sh
+++ b/deploy/self-hosted/smoke.sh
@@ -55,6 +55,9 @@ cp "$script_dir/compose.yml" "$script_dir/compose.smoke.yml" "$script_dir/Caddyf
 cp -R "$script_dir/../minio" "$smoke_dir/minio"
 cp -R "$script_dir/../tusd" "$smoke_dir/tusd"
 cp -R "$script_dir/../trust" "$smoke_dir/trust"
+# The private umask must not hide public trust files from non-root containers.
+chmod 755 "$smoke_dir/trust"
+chmod 644 "$smoke_dir/trust/ca-certificates.crt" "$smoke_dir/trust/clickhouse.xml"
 
 # Explicit files/project override any COMPOSE_* settings in the caller's shell.
 # The subshell also excludes inherited application credentials and feature flags.