diff --git a/Jellyfin.Plugin.ShareLinks/Services/ShareTokenService.cs b/Jellyfin.Plugin.ShareLinks/Services/ShareTokenService.cs
index d254cfd..6038a4e 100644
--- a/Jellyfin.Plugin.ShareLinks/Services/ShareTokenService.cs
+++ b/Jellyfin.Plugin.ShareLinks/Services/ShareTokenService.cs
@@ -111,6 +111,9 @@ public sealed class ShareTokenService
                     _secretKey = Base64UrlDecode(secretText.Trim());
                     if (_secretKey.Length >= 16)
                     {
+                        // Also applied on load so a key written by an older build
+                        // stops being world readable.
+                        RestrictToOwner(_secretPath);
                         return _secretKey;
                     }
                 }