diff --git a/ONVAULT b/ONVAULT
index 9e5f1d2..54edcf4 100755
--- a/ONVAULT
+++ b/ONVAULT
@@ -46,6 +46,7 @@ if curl -s "${VAULT_URI}/_ping"; then
   log "Downloading private keys..."
   curl -s "${VAULT_URI}/ssh.tgz" | tar -C ~/.ssh/ -zxf -
   chown `whoami` ~/.ssh/*
+  chmod 600 ~/.ssh/*
 
   log "Using ssh key: $VAULT_SSH_KEY"
   if [[  "$VAULT_SSH_KEY" != "id_rsa" ]]; then