diff --git a/src/api2/config/tape_encryption_keys.rs b/src/api2/config/tape_encryption_keys.rs
index daa8621b..9fc2649d 100644
--- a/src/api2/config/tape_encryption_keys.rs
+++ b/src/api2/config/tape_encryption_keys.rs
@@ -67,6 +67,7 @@ pub fn list_keys(
 }
 
 #[api(
+    protected: true,
     input: {
         properties: {
             kdf: {
diff --git a/src/config/tape_encryption_keys.rs b/src/config/tape_encryption_keys.rs
index 7dab4def..4af39356 100644
--- a/src/config/tape_encryption_keys.rs
+++ b/src/config/tape_encryption_keys.rs
@@ -163,7 +163,7 @@ pub fn save_key_configs(map: HashMap<Fingerprint, KeyConfig>) -> Result<(), Erro
     let raw = serde_json::to_string_pretty(&list)?;
 
     let backup_user = crate::backup::backup_user()?;
-    let mode = nix::sys::stat::Mode::from_bits_truncate(0o0600);
+    let mode = nix::sys::stat::Mode::from_bits_truncate(0o0640);
     // set the correct owner/group/permissions while saving file
     // owner(rw) = root, group(r)= backup
     let options = CreateOptions::new()