diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml
index ff056d4..671172f 100644
--- a/.forgejo/workflows/build.yaml
+++ b/.forgejo/workflows/build.yaml
@@ -8,8 +8,8 @@ jobs:
           cat <<EOF > $PWD/id_rsa
           ${{ secrets.SSH_KEY }}
           EOF
-          export NIX_SSHOPTS="-i $PWD/id_rsa"
-          nix flake update
+          chmod 600 $PWD/id_rsa
+          NIX_SSHOPTS='-i $PWD/id_rsa' nix flake update
       - run: nix build .#nixosConfigurations.orbi.config.system.build.toplevel
       - run: nix build .#nixosConfigurations.cream.config.system.build.toplevel
       - run: nix build .#nixosConfigurations.cherry.config.system.build.toplevel