diff --git a/gateway/registry.js b/gateway/registry.js
index de948d9..70df937 100644
--- a/gateway/registry.js
+++ b/gateway/registry.js
@@ -1,4 +1,4 @@
-import { readFile, writeFile } from 'node:fs/promises';
+import { readFile, writeFile, chmod } from 'node:fs/promises';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 
@@ -20,7 +20,8 @@ export async function loadRegistry() {
 
 export async function saveRegistry(registry) {
   const data = registry && typeof registry === 'object' ? registry : {};
-  await writeFile(REGISTRY_PATH, JSON.stringify(data, null, 2) + '\n', 'utf8');
+  await writeFile(REGISTRY_PATH, JSON.stringify(data, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
+  try { await chmod(REGISTRY_PATH, 0o600); } catch {}
 }
 
 export async function upsertEntry(entry) {