diff --git a/README.md b/README.md
index 7c5fffe..570fcf3 100644
--- a/README.md
+++ b/README.md
@@ -55,6 +55,20 @@ Encodes are written to a temporary file and renamed into place, so an
 interrupted run cannot leave a truncated MP3 that the next run mistakes for
 finished work. A lock file in the mirror root stops two passes overlapping.
 
+### Permissions
+
+Everything written into the mirror is made group-readable, and its directories
+group-traversable, so the mirror can be read back by whatever serves it. Neither
+writer does that unaided: the temporary file an encode renames into place is
+created `0600` regardless of the umask, and a straight copy of an existing MP3
+inherits the mode of a source file in a library this tool does not own. Only the
+group bits are touched; whether the mirror is world-readable stays with the
+umask, as does the ownership.
+
+Mirror files written before this existed are topped up on the next pass. Their
+mtimes are correct, so nothing else would revisit them — and they are not
+re-encoded, only chmod'ed.
+
 ## Usage
 
 ```sh