diff --git a/libs/secrets.js b/libs/secrets.js
index 46ea829f2..0b404f615 100644
--- a/libs/secrets.js
+++ b/libs/secrets.js
@@ -57,6 +57,8 @@ exports.hydrateSecret = function(name, dir) {
 
   if (secret === undefined) {
     secret = exports.generate(128);
+    fs.writeFileSync(p, '');
+    fs.chmodSync(p, 0600);
     fs.writeFileSync(p, secret);
   }
   return secret;