diff --git a/packages/cli/src/config/trustedFolders.test.ts b/packages/cli/src/config/trustedFolders.test.ts
index c8b34b765b..79330f1713 100644
--- a/packages/cli/src/config/trustedFolders.test.ts
+++ b/packages/cli/src/config/trustedFolders.test.ts
@@ -169,7 +169,7 @@ describe('Trusted Folders Loading', () => {
     expect(mockFsWriteFileSync).toHaveBeenCalledWith(
       USER_TRUSTED_FOLDERS_PATH,
       JSON.stringify({ '/new/path': TrustLevel.TRUST_FOLDER }, null, 2),
-      'utf-8',
+      { encoding: 'utf-8', mode: 0o600 },
     );
   });
 });
diff --git a/packages/cli/src/config/trustedFolders.ts b/packages/cli/src/config/trustedFolders.ts
index c25ff5de06..952110a772 100644
--- a/packages/cli/src/config/trustedFolders.ts
+++ b/packages/cli/src/config/trustedFolders.ts
@@ -150,7 +150,7 @@ export function saveTrustedFolders(
     fs.writeFileSync(
       trustedFoldersFile.path,
       JSON.stringify(trustedFoldersFile.config, null, 2),
-      'utf-8',
+      { encoding: 'utf-8', mode: 0o600 },
     );
   } catch (error) {
     console.error('Error saving trusted folders file:', error);