diff --git a/manage.py b/manage.py
index 7509931..eba10bb 100755
--- a/manage.py
+++ b/manage.py
@@ -147,14 +147,12 @@ def ui_build_time():
     return None
 
 def nginx_domain(port):
-    """Find nginx site proxying to our port. Uses sudo to read root-owned configs."""
+    """Find nginx site proxying to our port."""
     if not NGINX_DIR.exists():
         return None
     for f in NGINX_DIR.iterdir():
         try:
-            r = subprocess.run(['sudo', '-n', 'cat', str(f)],
-                               capture_output=True, text=True)
-            text = r.stdout if r.returncode == 0 else f.read_text()
+            text = f.read_text()
             if f':{port}' in text:
                 for line in text.splitlines():
                     if 'server_name' in line:
@@ -497,6 +495,7 @@ server {{
     if r.returncode != 0:
         err(f'Could not write {conf_path} — check sudo permissions')
         return
+    sudo_run(['chmod', '644', str(conf_path)])
     ok(f'nginx config written to {conf_path}')
 
     print('  Testing nginx configuration...')