diff --git a/apps/figcraft-server/src/store.rs b/apps/figcraft-server/src/store.rs
index 5ee9446d..e2eb6250 100644
--- a/apps/figcraft-server/src/store.rs
+++ b/apps/figcraft-server/src/store.rs
@@ -312,6 +312,10 @@ pub fn lock(root: &Path) -> Result<Option<File>, String> {
     #[cfg(unix)]
     std::os::unix::fs::DirBuilderExt::mode(&mut dirs, 0o700);
     dirs.create(root).map_err(|e| format!("can't create the data directory {}: {e}", root.display()))?;
+    // `DirBuilder` only applies the mode to directories it creates; tighten an existing one too.
+    #[cfg(unix)]
+    fs::set_permissions(root, std::os::unix::fs::PermissionsExt::from_mode(0o700))
+        .map_err(|e| format!("can't restrict the data directory {}: {e}", root.display()))?;
     let f = OpenOptions::new()
         .create(true)
         .truncate(false)
diff --git a/apps/figcraft-server/src/store_tests.rs b/apps/figcraft-server/src/store_tests.rs
index bc583369..ba8f955e 100644
--- a/apps/figcraft-server/src/store_tests.rs
+++ b/apps/figcraft-server/src/store_tests.rs
@@ -229,6 +229,17 @@ fn one_server_per_data_directory() {
     assert_eq!(again.key(), key, "the key is kept");
 }
 
+#[cfg(unix)]
+#[test]
+fn an_existing_data_directory_is_made_private() {
+    use std::os::unix::fs::PermissionsExt;
+    let dir = TempDir::new("perms");
+    fs::set_permissions(dir.path(), fs::Permissions::from_mode(0o755)).unwrap();
+    assert!(crate::store::lock(dir.path()).unwrap().is_some());
+    let mode = fs::metadata(dir.path()).unwrap().permissions().mode() & 0o777;
+    assert_eq!(mode, 0o700);
+}
+
 #[test]
 fn temporary_directories_are_removed() {
     let path = {