diff --git a/controller/internal/backup/backup.go b/controller/internal/backup/backup.go
index 0dce7f6..faa4560 100644
--- a/controller/internal/backup/backup.go
+++ b/controller/internal/backup/backup.go
@@ -553,7 +553,9 @@ func (m *Manager) tarVolumeOrDefault(volName, dumpDir string) ([]byte, error) {
 // error the tmp is left for the caller to remove; the final `.tar` is never touched here except by a
 // successful rename.
 func atomicPromoteTar(tmpPath, finalPath string) error {
-	f, err := os.Open(tmpPath)
+	// O_RDWR, not os.Open: fsync on a read-only handle is refused on Windows (dev-box test runs),
+	// while a writable handle syncs on every platform. Content is not modified.
+	f, err := os.OpenFile(tmpPath, os.O_RDWR, 0)
 	if err != nil {
 		return fmt.Errorf("opening tmp dump: %w", err)
 	}