diff --git a/hosts/laptop/secrets/default.nix b/hosts/laptop/secrets/default.nix
index f338ec26..f5757338 100644
--- a/hosts/laptop/secrets/default.nix
+++ b/hosts/laptop/secrets/default.nix
@@ -14,26 +14,32 @@ in {
     secrets = {
       ssh-config = {
         owner = username;
+        mode = "0600";
         path = "${home}/.ssh/config";
       };
       ssh-github-key = {
         owner = username;
+        mode = "0600";
         path = "${home}/.ssh/github";
       };
       anotherhadi-pgp-key = {
         owner = username;
+        mode = "0600";
         path = "${home}/.ssh/anotherhadi-priv.asc";
       };
       ssh-jack-key = {
         owner = username;
+        mode = "0600";
         path = "${home}/.ssh/jack";
       };
       signing-key = {
         owner = username;
+        mode = "0600";
         path = "${home}/.ssh/key";
       };
       signing-pub-key = {
         owner = username;
+        mode = "0600";
         path = "${home}/.ssh/key.pub";
       };
     };
diff --git a/hosts/work/secrets/default.nix b/hosts/work/secrets/default.nix
index 02dc26e6..49879f81 100644
--- a/hosts/work/secrets/default.nix
+++ b/hosts/work/secrets/default.nix
@@ -14,18 +14,22 @@ in {
     secrets = {
       ssh-config = {
         owner = username;
+        mode = "0600";
         path = "${home}/.ssh/config";
       };
       netrc = {
         owner = username;
+        mode = "0600";
         path = "${home}/.netrc";
       };
       ssh-github-key = {
         owner = username;
+        mode = "0600";
         path = "${home}/.ssh/github";
       };
       ssh-gitlab-key = {
         owner = username;
+        mode = "0600";
         path = "${home}/.ssh/gitlab";
       };
     };