diff --git a/hydra-module.nix b/hydra-module.nix
index 6fd1fd9f..a667bd4d 100644
--- a/hydra-module.nix
+++ b/hydra-module.nix
@@ -180,7 +180,7 @@ in
         after = [ "postgresql.service" ];
         environment = env;
         script = ''
-          mkdir -p ${baseDir}/data
+          mkdir -m 0700 -p ${baseDir}/data
           chown hydra ${baseDir}/data
           ln -sf ${hydraConf} ${baseDir}/data/hydra.conf
           ${optionalString (cfg.dbi == "dbi:Pg:dbname=hydra;user=hydra;") ''