diff --git a/physical/raft/snapshot.go b/physical/raft/snapshot.go
index 529c84f26..3f6e7a7d4 100644
--- a/physical/raft/snapshot.go
+++ b/physical/raft/snapshot.go
@@ -210,7 +210,7 @@ func (f *BoltSnapshotStore) getMetaFromDB(id string) (*raft.SnapshotMeta, error)
 	}
 
 	filename := filepath.Join(f.path, id, databaseFilename)
-	boltDB, err := bolt.Open(filename, 0o666, &bolt.Options{Timeout: 1 * time.Second})
+	boltDB, err := bolt.Open(filename, 0o600, &bolt.Options{Timeout: 1 * time.Second})
 	if err != nil {
 		return nil, err
 	}