diff --git a/ansible/k3s-kubeconfig-mode.yml b/ansible/k3s-kubeconfig-mode.yml
index 493d708..21bd994 100644
--- a/ansible/k3s-kubeconfig-mode.yml
+++ b/ansible/k3s-kubeconfig-mode.yml
@@ -305,3 +305,19 @@
             success_msg: >-
               admin kubeconfig {{ kubeconfig_stat.stat.pw_name }}:{{ kubeconfig_stat.stat.gr_name }}
               {{ kubeconfig_stat.stat.mode }}; API ready
+
+        # registries.yaml can hold registry logins; it was found 0644 on 2026-10-20
+        # by the RAIL-HO-WP-0014 posture check. k3s reads it as root at startup.
+        - name: Stat registries.yaml (metadata only)
+          ansible.builtin.stat:
+            path: /etc/rancher/k3s/registries.yaml
+            get_checksum: false
+          register: registries_stat
+
+        - name: Restrict registries.yaml to root (0600) when present
+          ansible.builtin.file:
+            path: /etc/rancher/k3s/registries.yaml
+            owner: root
+            group: root
+            mode: "0600"
+          when: k3s_kubeconfig_mode_action == 'apply' and registries_stat.stat.exists