diff --git a/configuration.nix b/configuration.nix
index 680401c..5e81350 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -564,7 +564,7 @@ in {
 
     matrix-synapse = {
       preStart = ''
-        mkdir -p /run/matrix-synapse/
+        umask 077
         ln -sf ''${CREDENTIALS_DIRECTORY}/jakstys.lt.signing.key /run/matrix-synapse/jakstys.lt.signing.key
         cat > /run/matrix-synapse/secrets.yaml <<EOF
         registration_shared_secret: "$(cat ''${CREDENTIALS_DIRECTORY}/registration_shared_secret)"
@@ -576,6 +576,9 @@ in {
         "registration_shared_secret:/var/src/secrets/synapse/registration_shared_secret"
         "macaroon_secret_key:/var/src/secrets/synapse/macaroon_secret_key"
       ];
+      tmpfiles.rules = [
+        "d /run/matrix-synapse 0700 matrix-synapse matrix-synapse -"
+      ];
     };
 
     cert-watcher = {