diff --git a/SECRETS.md b/SECRETS.md
index ea2728f..4bb5f81 100644
--- a/SECRETS.md
+++ b/SECRETS.md
@@ -64,7 +64,9 @@ can connect.
 These are read-only:
 - Role `bingo` gets SELECT on `bingo_datacenters` and `bingo_incidents` in
   the `asxpio` DB, and `default_transaction_read_only`.
-- The MinIO user may only `GetObject` under `asxpio-invoices/bingo/`.
+- The MinIO user may only `GetObject` in the `datacenterbingo-photos` bucket
+  (and, until the migration is cleaned up, under `asxpio-invoices/bingo/`).
+  asxpio's user has read-write on that bucket for the admin's uploads.
 
 The same values go on the **datacenterbingo repo**.
 
diff --git a/init/minio-bootstrap.sh b/init/minio-bootstrap.sh
index 58dd605..2715b32 100644
--- a/init/minio-bootstrap.sh
+++ b/init/minio-bootstrap.sh
@@ -58,26 +58,40 @@ EOF
     || mc admin policy update local "${name}" "/tmp/${name}.json"
 }
 
+# $3: one or more policy names, space-separated.
 ensure_user() {
   access="$1"
   secret="$2"
-  policy="$3"
+  policies="$3"
   if mc admin user info local "${access}" >/dev/null 2>&1; then
     # Rotate secret to match desired state.
     mc admin user remove local "${access}" >/dev/null
   fi
   mc admin user add local "${access}" "${secret}"
-  mc admin policy attach local "${policy}" --user "${access}" 2>/dev/null || true
+  # shellcheck disable=SC2086 # word-split the policy list on purpose
+  mc admin policy attach local ${policies} --user "${access}" 2>/dev/null || true
 }
 
 ensure_bucket "asxpio-invoices"
 write_policy  "asxpio-invoices-rw" "asxpio-invoices"
-ensure_user   "${ASXPIO_S3_ACCESS_KEY}" "${ASXPIO_S3_SECRET_KEY}" "asxpio-invoices-rw"
 
-# datacenterbingo serves the card photos asxpio's admin uploads under bingo/.
+# Datacenter bingo photos: uploaded and resized by asxpio's admin, served by
+# datacenterbingo. Keys keep their bingo/ prefix, so DB rows stay valid.
+ensure_bucket "datacenterbingo-photos"
+write_policy  "datacenterbingo-photos-rw" "datacenterbingo-photos"
+write_ro_prefix_policy "datacenterbingo-photos-ro" "datacenterbingo-photos" ""
+
+# Migration from asxpio-invoices/bingo/: copy whatever is missing. Remove
+# this (and the old bingo-ro policy below) once the old prefix is deleted.
+if mc ls "local/asxpio-invoices/bingo/" 2>/dev/null | grep -q .; then
+  mc mirror --quiet "local/asxpio-invoices/bingo" "local/datacenterbingo-photos/bingo"
+fi
+
+ensure_user   "${ASXPIO_S3_ACCESS_KEY}" "${ASXPIO_S3_SECRET_KEY}" "asxpio-invoices-rw datacenterbingo-photos-rw"
+
 if [ -n "${BINGO_S3_ACCESS_KEY:-}" ] && [ -n "${BINGO_S3_SECRET_KEY:-}" ]; then
   write_ro_prefix_policy "asxpio-invoices-bingo-ro" "asxpio-invoices" "bingo/"
-  ensure_user   "${BINGO_S3_ACCESS_KEY}" "${BINGO_S3_SECRET_KEY}" "asxpio-invoices-bingo-ro"
+  ensure_user   "${BINGO_S3_ACCESS_KEY}" "${BINGO_S3_SECRET_KEY}" "datacenterbingo-photos-ro asxpio-invoices-bingo-ro"
 else
   echo "minio-init: BINGO_S3_* unset, skipping bingo user"
 fi