diff --git a/README.md b/README.md
index da8f14c..d22dff4 100644
--- a/README.md
+++ b/README.md
@@ -32,7 +32,8 @@ Garage answers no anonymous S3 request. `public` is marked as a website
 instead, and Traefik sends unsigned GET/HEAD of
 `https://s3.asxp.io/public/<key>` to Garage's web endpoint. Anyone who knows a
 key can read it; nobody can list the bucket. Uploading needs the uploader key
-(see `SECRETS.md`).
+(see `SECRETS.md`) or asxpio's key, which may put and delete there for its
+admin's file uploads.
 
 ## Looking inside
 
diff --git a/init/garage-bootstrap.sh b/init/garage-bootstrap.sh
index 3963846..c74b76d 100644
--- a/init/garage-bootstrap.sh
+++ b/init/garage-bootstrap.sh
@@ -84,6 +84,8 @@ g bucket website --allow public >/dev/null
 asxpio="$(ensure_key asxpio "${ASXPIO_S3_ACCESS_KEY}" "${ASXPIO_S3_SECRET_KEY}")"
 grant "asxpio-invoices" "$asxpio" rw
 grant "datacenterbingo-photos" "$asxpio" rw
+# asxpio's admin publishes and retracts files; it keeps its own index.
+grant "public" "$asxpio" wo
 
 if [ -n "${BINGO_S3_ACCESS_KEY:-}" ] && [ -n "${BINGO_S3_SECRET_KEY:-}" ]; then
   bingo="$(ensure_key bingo "${BINGO_S3_ACCESS_KEY}" "${BINGO_S3_SECRET_KEY}")"