diff --git a/packages/mosaic/framework/install.sh b/packages/mosaic/framework/install.sh
index a8a81a0a..1578c33b 100755
--- a/packages/mosaic/framework/install.sh
+++ b/packages/mosaic/framework/install.sh
@@ -740,7 +740,11 @@ if [[ -d "$TARGET_DIR/fleet/agents" ]]; then
     warn "Could not set 0700 on $TARGET_DIR/fleet/agents — agent sessions will fail to start as unsafe-permissions."
 fi
 # credentials/ holds secrets and was never meant to be group-readable either.
-chmod 700 "$TARGET_DIR/credentials" 2>/dev/null || true
+# It is not on the fleet boundary, so a failure here breaks nothing — but it is
+# the one directory where a silently-failed chmod leaves secrets group-readable,
+# which is precisely the failure worth a line in the output.
+chmod 700 "$TARGET_DIR/credentials" 2>/dev/null || \
+  warn "Could not set 0700 on $TARGET_DIR/credentials — stored secrets may be readable by other users on this host."
 
 # Repair an existing tree. The umask above only governs directories this run
 # creates, so a host installed under umask 002 before this fix keeps its 0775