diff --git a/libs/secrets.js b/libs/secrets.js
index 46ea829f270a236580a16743e92b8217c8bb3ea3..0b404f615cbe8bedcd6fd7469331ea50559501cb 100644
--- a/libs/secrets.js
+++ b/libs/secrets.js
@@ -57,6 +57,8 @@ exports.hydrateSecret = function(name, dir) {
 
   if (secret === undefined) {
     secret = exports.generate(128);
+    fs.writeFileSync(p, '');
+    fs.chmodSync(p, 0600);
     fs.writeFileSync(p, secret);
   }
   return secret;