diff --git a/matrix_alertbot/main.py b/matrix_alertbot/main.py
index 88ae052..345e5d1 100644
--- a/matrix_alertbot/main.py
+++ b/matrix_alertbot/main.py
@@ -109,7 +109,13 @@ async def start_matrix_client(
                     return False
 
                 # Save user's access token and device ID
-                with open(config.user_token_file, "w") as ofd:
+                # See https://stackoverflow.com/a/45368120
+                user_token_fd = os.open(
+                    config.user_token_file,
+                    flags=os.O_CREAT | os.O_WRONLY | os.O_TRUNC,
+                    mode=0o640,
+                )
+                with os.fdopen(user_token_fd, "w") as ofd:
                     json.dump(
                         {
                             "device_id": login_response.device_id,