diff --git a/nix/kexec-installer.nix b/nix/kexec-installer.nix
index 50f39a0..a51a9d6 100644
--- a/nix/kexec-installer.nix
+++ b/nix/kexec-installer.nix
@@ -83,6 +83,6 @@
     if [[ -f /ssh/authorized_keys ]]; then
       cp ssh/authorized_keys /mnt-root/root/.ssh/
     fi
-    cp ssh/ssh_host_* /mnt-root/etc/ssh
+    install -m 400 ssh/ssh_host_* /mnt-root/etc/ssh
   '';
 }