diff --git a/modules/base/usr/ssh-all.nix b/modules/base/usr/ssh-all.nix
index 418f468..0176b88 100644
--- a/modules/base/usr/ssh-all.nix
+++ b/modules/base/usr/ssh-all.nix
@@ -5,12 +5,14 @@
     };
     sops.secrets."ssh/intern/private" = {
       path = "${config.home.homeDirectory}/.ssh/intern";
+      mode = "0600";
     };
     sops.secrets."ssh/extern/public" = {
       path = "${config.home.homeDirectory}/.ssh/extern.pub";
     };
     sops.secrets."ssh/extern/private" = {
       path = "${config.home.homeDirectory}/.ssh/extern";
+      mode = "0600";
     };
     programs.ssh.matchBlocks = {
       "intern" = {