Oops, I figured it out. If you want to query and set, you need both permissions:
reg.KEY_QUERY_VALUE | reg.KEY_SET_VALUE
Thanks to @RbMm for the advice