diff --git a/configuration.nix b/configuration.nix
index 57f0ee0..b7f55ba 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -86,6 +86,8 @@
       rm -fr ${config.boot.lanzaboote.pkiBundle} || true
       mkdir -p ${config.boot.lanzaboote.pkiBundle}
       ${pkgs.gnutar}/bin/tar xf ${./secrets/secureboot.tar} -C ${config.boot.lanzaboote.pkiBundle}
+      chown -R root:wheel ${config.boot.lanzaboote.pkiBundle}
+      chmod -R 700 ${config.boot.lanzaboote.pkiBundle}
     '';
   };