diff --git a/cicd_tool/main.py b/cicd_tool/main.py
index 6ed83d3..10341f1 100644
--- a/cicd_tool/main.py
+++ b/cicd_tool/main.py
@@ -81,6 +81,23 @@ def _create_minio_client() -> Minio:
     )
 
 
+def _public_read_policy(bucket_name: str) -> str:
+    """Anonymous read-only policy so the Tauri updater can fetch artifacts."""
+    return json.dumps(
+        {
+            "Version": "2012-10-17",
+            "Statement": [
+                {
+                    "Effect": "Allow",
+                    "Principal": {"AWS": ["*"]},
+                    "Action": ["s3:GetObject"],
+                    "Resource": [f"arn:aws:s3:::{bucket_name}/*"],
+                }
+            ],
+        }
+    )
+
+
 def _ensure_bucket(client: Minio, bucket_name: str) -> None:
     if not bucket_name:
         raise ConfigurationError("S3_BUCKET is required")
@@ -88,6 +105,12 @@ def _ensure_bucket(client: Minio, bucket_name: str) -> None:
     exists = client.bucket_exists(bucket_name)
     if not exists:
         client.make_bucket(bucket_name)
+        print(f"Created bucket '{bucket_name}'.")
+
+    # Always (re)apply public read so a freshly created -- or previously private --
+    # bucket can be read anonymously by the updater.
+    client.set_bucket_policy(bucket_name, _public_read_policy(bucket_name))
+    print(f"Ensured public read policy on bucket '{bucket_name}'.")
 
 
 def _collect_artifacts() -> List[Path]: