diff --git a/dist/chromium/publish-beta.py b/dist/chromium/publish-beta.py
index 3f90c524c..5a284ba7a 100755
--- a/dist/chromium/publish-beta.py
+++ b/dist/chromium/publish-beta.py
@@ -64,8 +64,11 @@ def input_secret(prompt, token):
         value = ubo_secrets[token]
     elif token not in ubo_secrets or value != ubo_secrets[token]:
         ubo_secrets[token] = value
+        exists = os.path.isfile(ubo_secrets_filename)
         with open(ubo_secrets_filename, 'w') as f:
             json.dump(ubo_secrets, f, indent=2)
+        if not exists:
+            os.chmod(ubo_secrets_filename, 0o600)
     return value
 
 
diff --git a/dist/firefox/publish-signed-beta.py b/dist/firefox/publish-signed-beta.py
index 301652fe9..65deae30c 100755
--- a/dist/firefox/publish-signed-beta.py
+++ b/dist/firefox/publish-signed-beta.py
@@ -82,8 +82,11 @@ def input_secret(prompt, token):
         value = ubo_secrets[token]
     elif token not in ubo_secrets or value != ubo_secrets[token]:
         ubo_secrets[token] = value
+        exists = os.path.isfile(ubo_secrets_filename)
         with open(ubo_secrets_filename, 'w') as f:
             json.dump(ubo_secrets, f, indent=2)
+        if not exists:
+            os.chmod(ubo_secrets_filename, 0o600)
     return value
 
 # GitHub API token