diff --git a/pkgs/clan-cli/clan_cli/facts/upload.py b/pkgs/clan-cli/clan_cli/facts/upload.py
index 8d8cf30d..6cb6bf8b 100644
--- a/pkgs/clan-cli/clan_cli/facts/upload.py
+++ b/pkgs/clan-cli/clan_cli/facts/upload.py
@@ -33,6 +33,8 @@ def upload_secrets(machine: Machine) -> None:
                     " ".join(["ssh"] + ssh_cmd[2:]),
                     "-az",
                     "--delete",
+                    "--chown=root:root",
+                    "--chmod=D700,F600",
                     f"{tempdir!s}/",
                     f"{host.user}@{host.host}:{machine.secrets_upload_directory}/",
                 ],