diff --git a/pica-etherpad-db/Dockerfile b/pica-etherpad-db/Dockerfile
index 179b0aec93ede0751298dca820e93e6f9f9e8880..f8dc06e0e9e87c26c754a93cb9cdda123774d1b0 100644
--- a/pica-etherpad-db/Dockerfile
+++ b/pica-etherpad-db/Dockerfile
@@ -1,4 +1,8 @@
 FROM mysql:8
 
 COPY config/limit_binary_log.cnf /etc/mysql/conf.d/limit_binary_log.cnf
-#
+
+# By default, COPY uses permissions `-rw-rw-rw-` for the file inside
+# the container. But mysql refuses to use config files that are world-
+# writable, so we have to change those permissions:
+RUN chmod 644 /etc/mysql/conf.d/limit_binary_log.cnf