diff --git a/src/updater/state.rs b/src/updater/state.rs
index 209d430..36ed497 100644
--- a/src/updater/state.rs
+++ b/src/updater/state.rs
@@ -6,6 +6,9 @@ use std::fs::OpenOptions;
 use std::io::{Read, Write};
 use std::path::Path;
 
+#[cfg(unix)]
+use std::os::unix::fs::OpenOptionsExt;
+
 use chrono::{Local, NaiveDateTime};
 use rand::prelude::*;
 use sequoia_openpgp::Fingerprint;
@@ -105,6 +108,7 @@ impl CertState {
         }
     }
 
+    /// Check if this certificate is already processed.
     pub fn need_processing(&self) -> bool {
         !(self.processed || (self.retry_count >= MAX_RETRY))
     }
@@ -217,7 +221,7 @@ impl UpdaterState {
     }
 
     /// Increment the retry count of the certificate (identified by its
-    /// fingerprint.
+    /// fingerprint).
     pub fn incr_retry_count(&mut self, fpr: &Fingerprint) {
         if let Some(entry) = self.certs.get_mut(fpr) {
             entry.incr_retry_count();
@@ -292,12 +296,14 @@ impl UpdaterState {
     pub async fn freeze(file: &Path, updater_state: &UpdaterState) -> Result<(), UpdaterError> {
         // freeze comes after thaw, so we assume that the parent directory
         // exists.
-        // XXX: on unix set mode 0o666
-        let mut handle = OpenOptions::new()
-            .write(true)
+        let mut options = OpenOptions::new();
+        options.write(true)
             .create(true)
-            .truncate(true)
-            .open(file)
+            .truncate(true);
+        #[cfg(unix)]
+        options.mode(0o600);
+
+        let mut handle = options.open(file)
             .map_err(|e| UpdaterError::IoError(e.to_string()))?;
 
         handle.write_all(updater_state.to_string().as_bytes())