diff --git a/go/daemon/bootstrap.go b/go/daemon/bootstrap.go
index 125b9f9..4fa5d4b 100644
--- a/go/daemon/bootstrap.go
+++ b/go/daemon/bootstrap.go
@@ -31,7 +31,7 @@ func writeBootstrapToStateDir(
 		return fmt.Errorf("creating directory %q: %w", dirPath, err)
 	}
 
-	if err := jsonutil.WriteFile(hostBootstrap, path, 0700); err != nil {
+	if err := jsonutil.WriteFile(hostBootstrap, path, 0600); err != nil {
 		return fmt.Errorf("writing bootstrap to %q: %w", path, err)
 	}
 
diff --git a/go/daemon/child_nebula.go b/go/daemon/child_nebula.go
index 6acc88d..d21f59a 100644
--- a/go/daemon/child_nebula.go
+++ b/go/daemon/child_nebula.go
@@ -137,7 +137,7 @@ func nebulaPmuxProcConfig(
 
 	nebulaYmlPath := filepath.Join(runtimeDirPath, "nebula.yml")
 
-	if err := yamlutil.WriteYamlFile(config, nebulaYmlPath, 0440); err != nil {
+	if err := yamlutil.WriteYamlFile(config, nebulaYmlPath, 0600); err != nil {
 		return pmuxlib.ProcessConfig{}, fmt.Errorf("writing nebula.yml to %q: %w", nebulaYmlPath, err)
 	}
 
diff --git a/go/garage/garagesrv/tpl.go b/go/garage/garagesrv/tpl.go
index adb7df3..27ff3c5 100644
--- a/go/garage/garagesrv/tpl.go
+++ b/go/garage/garagesrv/tpl.go
@@ -58,7 +58,7 @@ func RenderGarageToml(into io.Writer, data GarageTomlData) error {
 func WriteGarageTomlFile(path string, data GarageTomlData) error {
 
 	file, err := os.OpenFile(
-		path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0640,
+		path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600,
 	)
 
 	if err != nil {