diff --git a/remote-access/server/docker-entrypoint.sh b/remote-access/server/docker-entrypoint.sh
index 37288dd..943797e 100644
--- a/remote-access/server/docker-entrypoint.sh
+++ b/remote-access/server/docker-entrypoint.sh
@@ -1,5 +1,6 @@
 #!/bin/sh
 set -eu
+umask 077
 
 ca_key=${BOOTSTRAP_SSH_CA_KEY:-/var/lib/cangku-bootstrap/ssh_user_ca}
 if [ ! -f "$ca_key" ]; then