No idea how I could’ve missed it, but in the KeePass projects FAQ there is an explanation to the behaviour I was seeing as well as instructions how to fix it. Very embarrassing.

It seems that if the global .ini file exists it is loaded on start, but if it is readonly changed settings are stored in a per-user .ini file. But since the global one exists it is read on start, the old settings are used. So if the global one is deleted everything should work okey.

I wonder why they don’t try to read the per-user .ini file first though.