diff --git a/services/soulseek.nix b/services/soulseek.nix
index 4cdd268..86ba93c 100644
--- a/services/soulseek.nix
+++ b/services/soulseek.nix
@@ -17,6 +17,8 @@ in
       #!/bin/sh
       rm -fr ${slskd_env} || true
       cp ${../secrets/slskd_env} ${slskd_env}
+      chmod 0500 ${slskd_env}
+      chown ${config.services.slskd.user}:${config.services.slskd.group} ${slskd_env}
     '';
   };
 
diff --git a/zfs.nix b/zfs.nix
index b401255..a94f8d9 100644
--- a/zfs.nix
+++ b/zfs.nix
@@ -12,6 +12,8 @@ in
       #!/bin/sh
       rm -fr ${zfs-key} || true
       cp ${./secrets/zfs-key} ${zfs-key}
+      chmod 0500 ${zfs-key}
+      chown root:wheel ${zfs-key}
     '';
   };