diff --git a/install-root-w3bs-os.sh b/install-root-w3bs-os.sh
index 4c484bd..4fd3807 100644
--- a/install-root-w3bs-os.sh
+++ b/install-root-w3bs-os.sh
@@ -7,8 +7,8 @@
 # The script is fetched from this release's git tag and must match the sha256 below, so
 # the signed release installs exactly what was reviewed. Re-run to update.
 set -eu
-VERSION=0.1.0
-SHA256=de06d5cf0fd62d8f9a9d867a1e2a4eb753601ad7eaa2600a5ad7cf8788e54a76
+VERSION=0.1.1
+SHA256=b0500d02fb9ac589c37733f0d9bb0ef550cf24f44dcf0a984a811dd29923c3d5
 URL="https://raw.githubusercontent.com/profullstack/cli-tools/root-w3bs-os-v$VERSION/root-w3bs-os.sh"
 fail() { printf 'root-w3bs-os: %s\n' "$*" >&2; exit 1; }
 command -v curl >/dev/null 2>&1 || fail 'curl is required'
diff --git a/root-ubuntu.sh b/root-ubuntu.sh
index d47c436..ea06e29 100755
--- a/root-ubuntu.sh
+++ b/root-ubuntu.sh
@@ -4693,12 +4693,16 @@ try "networkd-dispatcher" quiet_networkd_dispatcher
 # refresh, so a slow/dead endpoint can never hang an ssh login.
 install_motd() {
 	local units_changed=0
+	# A cache written by an earlier refresher is 0600: "Permission denied" at every login.
+	[[ -f "$MOTD_CACHE" ]] && chmod 0644 "$MOTD_CACHE"
 	write_if_changed /usr/local/bin/profullstack-motd 0755 <<EOF && note "motd refresher"
 #!/bin/sh
 # refresh the cached motd from ${MOTD_URL}
 umask 022
 tmp="\$(mktemp)" || exit 0
 if curl -fsSL --max-time 10 '${MOTD_URL}' -o "\$tmp" && [ -s "\$tmp" ]; then
+	# mktemp makes the file 0600 whatever the umask; every login shell cats the cache.
+	chmod 0644 "\$tmp"
 	mv "\$tmp" '${MOTD_CACHE}'
 else
 	rm -f "\$tmp"
diff --git a/root-w3bs-os.sh b/root-w3bs-os.sh
index 7193325..8352e48 100755
--- a/root-w3bs-os.sh
+++ b/root-w3bs-os.sh
@@ -186,7 +186,7 @@ set -uo pipefail
 
 # The packaged release (w3bs install profullstack.com/root-w3bs-os). Bump with every
 # change that ships, and tag the commit root-w3bs-os-v<version>.
-ROOT_W3BS_OS_VERSION=0.1.0
+ROOT_W3BS_OS_VERSION=0.1.1
 case "${1:-}" in
 	--version|-V) printf 'root-w3bs-os %s\n' "$ROOT_W3BS_OS_VERSION"; exit 0 ;;
 esac
@@ -5104,12 +5104,16 @@ try "fail2ban" configure_fail2ban
 # through Alpine's /etc/zsh/zprofile.
 install_motd() {
 	local units_changed=0
+	# A cache written by an earlier refresher is 0600: "Permission denied" at every login.
+	[[ -f "$MOTD_CACHE" ]] && chmod 0644 "$MOTD_CACHE"
 	write_if_changed /usr/local/bin/profullstack-motd 0755 <<EOF && note "motd refresher"
 #!/bin/sh
 # refresh the cached motd from ${MOTD_URL}
 umask 022
 tmp="\$(mktemp)" || exit 0
 if curl -fsSL --max-time 10 '${MOTD_URL}' -o "\$tmp" && [ -s "\$tmp" ]; then
+	# mktemp makes the file 0600 whatever the umask; every login shell cats the cache.
+	chmod 0644 "\$tmp"
 	mv "\$tmp" '${MOTD_CACHE}'
 else
 	rm -f "\$tmp"