diff --git a/docker-compose.yml b/docker-compose.yml
index f57614d..018ec9a 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,5 +1,3 @@
-version: "3.7"
-
 # YAML Anchors
 
 x-deployment-env: &deployment-env
@@ -57,4 +55,4 @@ services:
         condition: service_healthy
     environment:
       GITHUB_ACTION: ${GITHUB_ACTION:-}
-      PG_DATABASE_URL: ${PG_DATABASE_URL:-postgresql://postgres:password@postgres:5432/place_development}
\ No newline at end of file
+      PG_DATABASE_URL: ${PG_DATABASE_URL:-postgresql://postgres:password@postgres:5432/place_development}
diff --git a/shard.lock b/shard.lock
index 60305ee..09c17b9 100644
--- a/shard.lock
+++ b/shard.lock
@@ -139,7 +139,7 @@ shards:
 
   placeos-models:
     git: https://github.com/placeos/models.git
-    version: 9.62.4
+    version: 9.64.0
 
   placeos-resource:
     git: https://github.com/place-labs/resource.git
diff --git a/spec/loader_spec.cr b/spec/loader_spec.cr
index 203f210..dcf2247 100644
--- a/spec/loader_spec.cr
+++ b/spec/loader_spec.cr
@@ -51,6 +51,7 @@ module PlaceOS::FrontendLoader
         repository = example_repository(commit: "f7c6d8fb810c2be78722249e06bbfbda3d30d355")
         repository.password = old_token
         repository.save!
+        sleep 200.milliseconds
 
         loader = Loader.new
 
@@ -60,12 +61,13 @@ module PlaceOS::FrontendLoader
         repository.password = new_token
         repository.password_will_change!
         repository.save!
+        sleep 200.milliseconds
 
         repository = repository.class.find!(repository.id.not_nil!)
         loader.process_resource(:updated, repository).success?.should be_true
 
         changefeed.stop
-        changes.size.should eq 3
+        changes.size.should eq 4
 
         repository.reload!
         encrypted = repository.password.not_nil!
diff --git a/src/config.cr b/src/config.cr
index c60dcb8..d6e7a8f 100644
--- a/src/config.cr
+++ b/src/config.cr
@@ -14,3 +14,22 @@ ActionController::Server.before(
   ActionController::ErrorHandler.new(PlaceOS::FrontendLoader::PROD, ["X-Request-ID"]),
   ActionController::LogHandler.new(ms: true)
 )
+
+# Crystal lang attempts to set permissions after copy
+# remove after https://github.com/crystal-lang/crystal/pull/15510 merged
+require "file"
+
+class File < IO::FileDescriptor
+  def self.copy(src : String | Path, dst : String | Path) : Nil
+    open(src) do |s|
+      open(dst, "wb") do |d|
+        # TODO use sendfile or copy_file_range syscall. See #8926, #8919
+        IO.copy(s, d)
+        d.flush # need to flush in case permissions are read-only
+
+        # Set the permissions after the content is written in case src permissions is read-only
+        d.chmod(s.info.permissions) rescue nil
+      end
+    end
+  end
+end
diff --git a/test b/test
index 0ce6c53..b2af158 100755
--- a/test
+++ b/test
@@ -5,7 +5,7 @@ set -eu
 # this function is called when Ctrl-C is sent
 function trap_ctrlc ()
 {
-    docker-compose down &> /dev/null
+    docker compose down &> /dev/null
     exit 2
 }
 
@@ -13,17 +13,17 @@ function trap_ctrlc ()
 # when signal 2 (SIGINT) is received
 trap "trap_ctrlc" 2
 
-docker-compose pull -q
+docker compose pull -q
 
-docker-compose build -q
+docker compose build -q
 
 exit_code="0"
 
-docker-compose run \
+docker compose run \
         --rm \
         test $@ \
     || exit_code="$?"
 
-docker-compose down &> /dev/null
+docker compose down &> /dev/null
 
 exit ${exit_code}