diff --git a/nixos/modules/config/swap.nix b/nixos/modules/config/swap.nix
index 427b2519cbd..ac1c32387c5 100644
--- a/nixos/modules/config/swap.nix
+++ b/nixos/modules/config/swap.nix
@@ -106,6 +106,7 @@ with utils;
                 if [ ! -e "${sw.device}" ]; then
                   fallocate -l ${toString sw.size}M "${sw.device}" ||
                     dd if=/dev/zero of="${sw.device}" bs=1M count=${toString sw.size}
+                  chmod 0600 ${sw.device}
                   mkswap ${sw.device}
                 fi
               '';