diff --git a/src/main.rs b/src/main.rs
index 6335e8f..10a40fe 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -44,7 +44,12 @@ enum Action {
 fn setup(args: SetupArgs) -> Result<(), std::io::Error> {
     if let Ok(config_template) = std::fs::read_to_string(CONFIG_TEMPLATE_PATH) {
         let filled_in_config = formatx!(config_template, args.api_url, args.rest_url, args.username, args.botpassword, args.oauth2_token).unwrap();
-        std::fs::write(shellexpand::tilde(BOT_CONFIG_PATH).into_owned(), filled_in_config).unwrap();
+        let path = shellexpand::tilde(BOT_CONFIG_PATH).into_owned();
+        std::fs::write(&path, filled_in_config).unwrap();
+        {
+            use std::os::unix::fs::PermissionsExt;
+            std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o600))?;
+        }
         Ok(())
     } else {
         Err(std::io::Error::new(std::io::ErrorKind::NotFound, format!("Unable to find {}; did you execute the script from the same directory?", CONFIG_TEMPLATE_PATH)))