diff --git a/config/initializers/secret_token.rb b/config/initializers/secret_token.rb
index 7b86afb2..da6b0f40 100644
--- a/config/initializers/secret_token.rb
+++ b/config/initializers/secret_token.rb
@@ -26,9 +26,9 @@
   # Randomly generate a secret and store it in config/secret_key_base.#{env}.txt
   # Code inspired by Rails.application.generate_local_secret
   # (https://github.com/rails/rails/blob/v7.1.2/railties/lib/rails/application.rb#L665)
-  file = Rails.root.join("config/secret_key_base.#{Rails.env}.txt")
-  if !File.exist?(file)
-    File.binwrite(file, SecureRandom.hex(64))
+  filename = Rails.root.join("config/secret_key_base.#{Rails.env}.txt")
+  if !File.exist?(filename)
+    File.open(filename, "wb", 0o600) { |f| f.write(SecureRandom.hex(64)) }
   end
-  NZTrain::Application.config.secret_key_base = File.binread(file).strip
+  NZTrain::Application.config.secret_key_base = File.binread(filename).strip
 end