diff --git a/nixos/modules/services/security/nginx-sso.nix b/nixos/modules/services/security/nginx-sso.nix
index 437eb0c62796..f6e3b5deef1d 100644
--- a/nixos/modules/services/security/nginx-sso.nix
+++ b/nixos/modules/services/security/nginx-sso.nix
@@ -65,6 +65,7 @@ in
         StateDirectory = "nginx-sso";
         WorkingDirectory = "/var/lib/nginx-sso";
         RuntimeDirectory = "nginx-sso";
+        RuntimeDirectoryMode = "0700"; # Contains secrets
         ExecStart = ''
           ${lib.getExe cfg.package} \
             --config ${configPath} \