diff --git a/agent/ShopDbEndpointAgent.Core/CertificateRenewal.cs b/agent/ShopDbEndpointAgent.Core/CertificateRenewal.cs
index a01329e3..c5c8a2f9 100644
--- a/agent/ShopDbEndpointAgent.Core/CertificateRenewal.cs
+++ b/agent/ShopDbEndpointAgent.Core/CertificateRenewal.cs
@@ -1,6 +1,7 @@
 using System;
 using System.IO;
 using System.Net.Http;
+using System.Security.AccessControl;
 using System.Security.Cryptography.X509Certificates;
 using System.Text;
 using System.Text.Json;
@@ -287,14 +288,14 @@ public class CertificateRenewal
                     var keyFile = Path.Combine(searchPath, keyPath);
                     if (File.Exists(keyFile))
                     {
-                        var acl = File.GetAccessControl(keyFile);
-                        var rule = new System.Security.AccessControl.FileSystemAccessRule(
+                        var fileInfo = new FileInfo(keyFile);
+                        var acl = fileInfo.GetAccessControl();
+                        var rule = new FileSystemAccessRule(
                             "BUILTIN\\Users",
-                            System.Security.AccessControl.FileSystemRights.Read |
-                            System.Security.AccessControl.FileSystemRights.ReadAndExecute,
-                            System.Security.AccessControl.AccessControlType.Allow);
+                            FileSystemRights.Read | FileSystemRights.ReadAndExecute,
+                            AccessControlType.Allow);
                         acl.AddAccessRule(rule);
-                        File.SetAccessControl(keyFile, acl);
+                        fileInfo.SetAccessControl(acl);
 
                         logger.LogInformation("Granted Users group access to private key at {KeyFile}", keyFile);
                         return;
diff --git a/agent/ShopDbEndpointAgent.Core/ShopDbEndpointAgent.Core.csproj b/agent/ShopDbEndpointAgent.Core/ShopDbEndpointAgent.Core.csproj
index ee711845..1a248310 100644
--- a/agent/ShopDbEndpointAgent.Core/ShopDbEndpointAgent.Core.csproj
+++ b/agent/ShopDbEndpointAgent.Core/ShopDbEndpointAgent.Core.csproj
@@ -21,6 +21,9 @@
 		 explicit DACL. The service creates it as LocalSystem, and without a
 		 granted ACE the unelevated tray cannot open it. -->
 	<PackageReference Include="System.Threading.AccessControl" Version="8.0.0" />
+	<!-- FileSystem.AccessControl: setting ACLs on private key files for certificate
+		 renewal (File.GetAccessControl/SetAccessControl moved to this package in .NET 8+) -->
+	<PackageReference Include="System.IO.FileSystem.AccessControl" Version="5.0.0" />
   </ItemGroup>
 
 </Project>