diff --git a/public/api/contact.php b/public/api/contact.php
index bbad0af..7042dbe 100644
--- a/public/api/contact.php
+++ b/public/api/contact.php
@@ -4,9 +4,10 @@ header('Access-Control-Allow-Origin: https://sag24.ru');
 header('Access-Control-Allow-Methods: POST');
 header('Access-Control-Allow-Headers: Content-Type');
 
-// Load secrets from outside webroot (not in git)
+// Load secrets from outside webroot (not in git).
+// Use is_readable() not file_exists() — PHP-FPM may lack read permission even when file is present.
 $configFile = dirname(__DIR__, 2) . '/contact-config.php';
-if (file_exists($configFile)) {
+if (is_readable($configFile)) {
     require_once $configFile;
 } else {
     // Fallback values for local development (override via contact-config.php on server)