diff --git a/lib/kamal/cli/app/ssl_certificates.rb b/lib/kamal/cli/app/ssl_certificates.rb
index a025d14af..95e28dfd9 100644
--- a/lib/kamal/cli/app/ssl_certificates.rb
+++ b/lib/kamal/cli/app/ssl_certificates.rb
@@ -16,7 +16,7 @@ def run
         upload!(StringIO.new(cert_content), role.proxy.host_tls_cert, mode: "0644")
       end
       if key_content = role.proxy.private_key_pem_content
-        upload!(StringIO.new(key_content), role.proxy.host_tls_key, mode: "0644")
+        upload!(StringIO.new(key_content), role.proxy.host_tls_key, mode: "0600")
       end
     end
   end