diff --git a/meson.build b/meson.build
index 8262f5ff76b..92b9a6ce5b2 100644
--- a/meson.build
+++ b/meson.build
@@ -3851,7 +3851,9 @@ public_programs += executable(
 # there.
 meson.add_install_script('sh', '-c', mkdir_p.format(credstoredir))
 if install_sysconfdir
+        # Keep in sync with tmpfiles.d/credstore.conf
         meson.add_install_script('sh', '-c', mkdir_p_mode.format(sysconfdir / 'credstore', '0700'))
+        meson.add_install_script('sh', '-c', mkdir_p_mode.format(sysconfdir / 'credstore.encrypted', '0700'))
 endif
 
 executable(
diff --git a/tmpfiles.d/credstore.conf b/tmpfiles.d/credstore.conf
index fb1ccf82d2a..de250f7561f 100644
--- a/tmpfiles.d/credstore.conf
+++ b/tmpfiles.d/credstore.conf
@@ -7,7 +7,7 @@
 
 # See tmpfiles.d(5) for details
 
-d /etc/credstore 0000 root root
-d /etc/credstore.encrypted 0000 root root
-z /run/credstore 0000 root root
-z /run/credstore.encrypted 0000 root root
+d /etc/credstore 0700 root root
+d /etc/credstore.encrypted 0700 root root
+z /run/credstore 0700 root root
+z /run/credstore.encrypted 0700 root root