diff --git a/modules/jwtx/signingkey.go b/modules/jwtx/signingkey.go
index d3652d9414..6ce014ee11 100644
--- a/modules/jwtx/signingkey.go
+++ b/modules/jwtx/signingkey.go
@@ -338,7 +338,7 @@ func loadOrCreateAsymmetricKey(keyPath, algorithm string) (any, error) {
 				return err
 			}
 
-			f, err := os.OpenFile(keyPath, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0o600)
+			f, err := os.OpenFile(keyPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o600)
 			if err != nil {
 				return err
 			}