diff --git a/wireguard/make.sh b/wireguard/make.sh
index a11aad5..99beb31 100755
--- a/wireguard/make.sh
+++ b/wireguard/make.sh
@@ -106,7 +106,6 @@ echo "# Copying assets..."
 echo "# Setup: wireguard default profile..."
 @ lxc-attach $ID -- bash -c "cd /root \
 	&& QRCODE=${QRCODE} make default.client" 
-@ lxc-attach $ID -- chmod 600 /etc/wireguard/wg0.conf
 
 echo "# client config:"
 @ mkdir -p clients
diff --git a/wireguard/templates/root/Makefile b/wireguard/templates/root/Makefile
index 4d6ea0a..d50a7f5 100644
--- a/wireguard/templates/root/Makefile
+++ b/wireguard/templates/root/Makefile
@@ -39,6 +39,7 @@ $(SERVER_CONF): $(SERVER_TPL) $(SERVER_KEY)
 			-e 's/\$${\CLIENT_IPS}/$(subst /,\/,$(CLIENT_IPS))/g' \
 			-e 's/\$${\SERVER_PRIVATE_KEY}/'$$(sed -e 's/\//\\\//g' "$(SERVER_KEY)")'/g' \
 		> "$@"
+	chmod 600 $@
 
 # XXX need to figure out a way to link this to the .config file without 
 # 	conflicting with the server's wg0.conf