diff --git a/charts/tenant/templates/minio-setup.yaml b/charts/tenant/templates/minio-setup.yaml
index af1f9c6..224c10f 100644
--- a/charts/tenant/templates/minio-setup.yaml
+++ b/charts/tenant/templates/minio-setup.yaml
@@ -21,20 +21,64 @@ spec:
           command: ["/bin/sh", "-c"]
           args:
             - |
+              set -e
+
+              # Generate password
+              SCOPED_SECRET=$(tr -dc 'a-zA-Z0-9' < /dev/urandom | head -c 32)
+
+              # Configure MinIO alias
               mc alias set local http://minio.minio.svc:9000 \
                 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"
 
+              # Create buckets
               mc mb -p local/{{ .Values.name }}-ref local/{{ .Values.name }}-work
-              mc admin user add local {{ .Values.name }}-user "$(openssl rand -hex 16)" || true
-              mc admin policy create local {{ .Values.name }}-policy /policies/{{ .Values.name }}.json
+
+              # Create user with generated credentials
+              mc admin user add local {{ .Values.name }}-user "$SCOPED_SECRET"
+
+              # Inline policy generation to avoid missing mount issues
+              cat <<EOF > /tmp/policy.json
+              {
+                "Version": "2012-10-17",
+                "Statement": [
+                  {
+                    "Sid": "ReadOnlyRefBucket",
+                    "Effect": "Allow",
+                    "Action": [
+                      "s3:GetBucketLocation",
+                      "s3:ListBucket",
+                      "s3:GetObject"
+                    ],
+                    "Resource": [
+                      "arn:aws:s3:::{{ .Values.name }}-ref",
+                      "arn:aws:s3:::{{ .Values.name }}-ref/*"
+                    ]
+                  },
+                  {
+                    "Sid": "ReadWriteWorkBucket",
+                    "Effect": "Allow",
+                    "Action": [
+                      "s3:*"
+                    ],
+                    "Resource": [
+                      "arn:aws:s3:::{{ .Values.name }}-work",
+                      "arn:aws:s3:::{{ .Values.name }}-work/*"
+                    ]
+                  }
+                ]
+              }
+              EOF
+              # Apply policy and attach to user
+              mc admin policy create local {{ .Values.name }}-policy /tmp/policy.json
               mc admin policy attach local {{ .Values.name }}-policy --user {{ .Values.name }}-user
 
-              # write the SCOPED secret in this same namespace
+              # Create target secret with matching credentials
               kubectl create secret generic {{ .Values.name }}-s3-credentials \
                 --from-literal=AWS_ACCESS_KEY_ID={{ .Values.name }}-user \
                 --from-literal=AWS_SECRET_ACCESS_KEY="$SCOPED_SECRET" \
                 -n minio --dry-run=client -o yaml | kubectl apply -f -
 
+              # Annotate for Emberstack Reflector
               kubectl annotate secret {{ .Values.name }}-s3-credentials -n minio --overwrite \
                 reflector.v1.k8s.emberstack.com/reflection-allowed="true" \
                 reflector.v1.k8s.emberstack.com/reflection-auto-enabled="true" \
diff --git a/images/minio-setup-runner/dockerfile b/images/minio-setup-runner/dockerfile
index ada5bb6..046ad29 100644
--- a/images/minio-setup-runner/dockerfile
+++ b/images/minio-setup-runner/dockerfile
@@ -1,6 +1,6 @@
 FROM alpine:3.20
 
-RUN apk add --no-cache curl bash \
+RUN apk add --no-cache curl bash openssl \
     && curl -fsSL -o /usr/local/bin/mc https://dl.min.io/client/mc/release/linux-amd64/mc \
     && chmod +x /usr/local/bin/mc \
     && curl -fsSL -o /usr/local/bin/kubectl "https://dl.k8s.io/release/$(curl -fsSL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" \