diff --git a/conservancy_beancount/config.py b/conservancy_beancount/config.py
index de9b1f42d3e44a70ff51635c2a3ed1f11b9b38c5..39a0d1a7b2814e94df85733284b3dcb0340c1cbf 100644
--- a/conservancy_beancount/config.py
+++ b/conservancy_beancount/config.py
@@ -134,7 +134,13 @@ class Config:
                 credentials.user,
                 urlparse.quote(str(credentials.server), ''),
             )
-            cache_db = rtutil.RTLinkCache.setup(cache_dir_path / cache_name)
+            cache_path = cache_dir_path / cache_name
+            try:
+                cache_path.touch(0o600)
+            except OSError:
+                # RTLinkCache.setup() will handle the problem.
+                pass
+            cache_db = rtutil.RTLinkCache.setup(cache_path)
         return rtutil.RT(wrapper_client, cache_db)
 
     def rt_wrapper(self,
diff --git a/tests/test_config.py b/tests/test_config.py
index ef3a6438907bde57e1f244a71ab2c7621fad7df8..6925293c054201feaf368ffb7b4107a0cff2be2b 100644
--- a/tests/test_config.py
+++ b/tests/test_config.py
@@ -74,6 +74,14 @@ def update_environ(**kwargs):
     finally:
         _update_environ(revert)
 
+@contextlib.contextmanager
+def update_umask(mask):
+    old_mask = os.umask(mask)
+    try:
+        yield old_mask
+    finally:
+        os.umask(old_mask)
+
 def test_repository_from_environment():
     config = config_mod.Config()
     assert config.repository_path() == testutil.test_path('repository')
@@ -208,12 +216,15 @@ def test_rt_wrapper_cache_responds_to_external_credential_changes(rt_environ):
     assert rt1 is not rt2
 
 def test_rt_wrapper_has_cache(tmp_path):
-    with update_environ(XDG_CACHE_DIR=tmp_path):
+    with update_environ(XDG_CACHE_DIR=tmp_path), update_umask(0o002):
         config = config_mod.Config()
         rt = config.rt_wrapper(None, testutil.RTClient)
         rt.exists(1)
     expected = 'conservancy_beancount/{}@*.sqlite3'.format(RT_FILE_CREDS[1])
-    assert any(tmp_path.glob(expected))
+    actual = None
+    for actual in tmp_path.glob(expected):
+        assert not actual.stat().st_mode & 0o177
+    assert actual is not None, "did not find any generated cache file"
 
 def test_rt_wrapper_without_cache(tmp_path):
     tmp_path.chmod(0)