diff --git a/pkgs/clan-cli/clan_cli/vars/secret_modules/password_store.py b/pkgs/clan-cli/clan_cli/vars/secret_modules/password_store.py
index c804456f3..4b748da84 100644
--- a/pkgs/clan-cli/clan_cli/vars/secret_modules/password_store.py
+++ b/pkgs/clan-cli/clan_cli/vars/secret_modules/password_store.py
@@ -113,5 +113,7 @@ class SecretStore(SecretStoreBase):
                 else:
                     # TODO: drop old format soon
                     secret_name = secret
-                (output_dir / secret_name).write_bytes(self.get(service, secret_name))
+                with (output_dir / secret_name).open("wb") as f:
+                    f.chmod(0o600)
+                    f.write(self.get(service, secret_name))
         (output_dir / ".pass_info").write_bytes(self.generate_hash())