diff --git a/scripts/provider-bootstrap.ts b/scripts/provider-bootstrap.ts
index 7e5d1f66..3640f378 100644
--- a/scripts/provider-bootstrap.ts
+++ b/scripts/provider-bootstrap.ts
@@ -123,7 +123,7 @@ async function main(): Promise<void> {
   }
 
   const outputPath = resolve(process.cwd(), '.openclaude-profile.json')
-  writeFileSync(outputPath, JSON.stringify(profile, null, 2), 'utf8')
+  writeFileSync(outputPath, JSON.stringify(profile, null, 2), { encoding: 'utf8', mode: 0o600 })
 
   console.log(`Saved profile: ${selected}`)
   console.log(`Path: ${outputPath}`)