diff --git a/docker/wg/clusev-wg-request.service b/docker/wg/clusev-wg-request.service
index 337a0c2..ed07f7c 100644
--- a/docker/wg/clusev-wg-request.service
+++ b/docker/wg/clusev-wg-request.service
@@ -9,6 +9,8 @@ After=docker.service
 [Service]
 Type=oneshot
 User=root
+# Result/QR files carry a freshly-minted private key — keep them 0600 from birth (run/ is 0775).
+UMask=0077
 Environment=CLUSEV_DIR=/home/nexxo/clusev
 WorkingDirectory=/home/nexxo/clusev
 ExecStart=/home/nexxo/clusev/docker/wg/clusev-wg.sh serve-request
diff --git a/docker/wg/clusev-wg.sh b/docker/wg/clusev-wg.sh
index 3c5842b..2e31ec2 100755
--- a/docker/wg/clusev-wg.sh
+++ b/docker/wg/clusev-wg.sh
@@ -311,6 +311,7 @@ _write_result() {
 # Process one UI write-request. Whitelists the action + re-validates every arg HOST-SIDE.
 cmd_serve_request() {
   need_root serve-request
+  umask 077   # result + QR sidecar carry a private key — born 0600, never world-readable in run/ (0775)
   local req="${RUN_DIR}/wg-request.json" work="${RUN_DIR}/wg-request.processing"
   [ -f "$req" ] || return 0
   mv -f "$req" "$work" 2>/dev/null || return 0