diff --git a/modules/nixos/services/vouch-proxy.nix b/modules/nixos/services/vouch-proxy.nix
index 53215dee..d162607c 100644
--- a/modules/nixos/services/vouch-proxy.nix
+++ b/modules/nixos/services/vouch-proxy.nix
@@ -70,6 +70,7 @@ let
           ${pkgs.writeScript
             "vouch-proxy-replace-secrets"
             (utils.genJqSecretsReplacementSnippet settings settingsFile')}
+          chmod 0600 "${settingsFile'}"
         ''
         else ''
           install -Dm0600 "${settingsFile}" "${settingsFile'}"