diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 57a205233e..9c651acbf2 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -272,6 +272,14 @@ jobs:
           cache-from: type=gha,scope=federation
           cache-to: type=gha,mode=max,scope=federation
 
+      # Federation runs the container as the host user, not as the image user
+      - name: Check the federation image entry point is readable by another uid
+        run: >-
+          docker run --rm --user 490:490 --entrypoint bash
+          ghcr.io/${{ github.repository }}:${{ github.sha }}-federation
+          -c 'cd /home/scality/s3 && [[ -r index.js ]] ||
+          { echo "index.js not readable by uid $(id -u)"; exit 1; }'
+
       - name: Build and push pykmip image
         uses: docker/build-push-action@v5
         with:
diff --git a/images/federation/Dockerfile b/images/federation/Dockerfile
index 9a8d5eb161..f41f0b7026 100644
--- a/images/federation/Dockerfile
+++ b/images/federation/Dockerfile
@@ -19,7 +19,10 @@ ENV HOME_DIR="/home/${USER}" \
     DATA_DIR="/data" \
     SUP_RUN_DIR="/var/run/supervisor"
 
-RUN mv /home/node ${HOME_DIR} && usermod --login ${USER} --shell /bin/bash -d ${HOME_DIR} node
+# Federation runs the container as the host user, not as ${USER}, so the home
+# dir must stay traversable (the trixie node image creates /home/node as 700)
+RUN mv /home/node ${HOME_DIR} && chmod 755 ${HOME_DIR} && \
+    usermod --login ${USER} --shell /bin/bash -d ${HOME_DIR} node
 RUN mkdir ${LOG_DIR} && chown ${USER} ${LOG_DIR} && \
     mkdir ${CONF_DIR} && chown ${USER} ${CONF_DIR} && \
     mkdir ${DATA_DIR} && chown ${USER} ${DATA_DIR} && \
diff --git a/package.json b/package.json
index 51f97381c5..c17ff93fb3 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@scality/cloudserver",
-    "version": "9.5.0",
+    "version": "9.5.1",
     "description": "Zenko CloudServer, an open-source Node.js implementation of a server handling the Amazon S3 protocol",
     "main": "index.js",
     "engines": {