diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 1fdbd6c5..71634b76 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -94,8 +94,8 @@ services:
       /usr/bin/mc mb myminio/familienarchiv --ignore-existing;
       /usr/bin/mc anonymous set private myminio/familienarchiv;
       /usr/bin/mc admin user add myminio archiv-app $$MINIO_APP_PASSWORD || /usr/bin/mc admin user enable myminio archiv-app;
-      /usr/bin/mc admin policy attach myminio readwrite --user archiv-app || true;
-      exit 0;
+      /usr/bin/mc admin policy attach myminio readwrite --user archiv-app 2>/dev/null || true;
+      /usr/bin/mc admin user info myminio archiv-app | grep -q readwrite || { echo 'FATAL: archiv-app is missing the readwrite policy'; exit 1; };
       "
 
   # Dev-only mail catcher; gated behind the staging profile so production