diff --git a/Makefile b/Makefile
index f38fe34..3508c8b 100644
--- a/Makefile
+++ b/Makefile
@@ -93,6 +93,7 @@ ifdef DEPLOY_HOSTS
 	@- $(foreach host,$(DEPLOY_HOSTS), \
 		ssh $(SSH_USER)@$(host) "mkdir -p $(DEPLOY_PATH)/$(DEPLOY_NAME)"; \
 		rsync -rav --exclude '*~' --exclude '.git*' --exclude '*.swp' . $(SSH_USER)@$(host):$(DEPLOY_PATH)/$(DEPLOY_NAME); \
+		ssh $(SSH_USER)@$(host) "cd $(DEPLOY_PATH)/$(DEPLOY_NAME) && chmod o-r .env secrets*" \
 	)
 endif