diff --git a/.gitea/workflows/build_push.yml b/.gitea/workflows/build_push.yml
index edbd23e..e1de732 100644
--- a/.gitea/workflows/build_push.yml
+++ b/.gitea/workflows/build_push.yml
@@ -114,7 +114,12 @@ jobs:
       - name: Create Kubeconfig
         run: |
           mkdir -p $HOME/.kube
+          # Written with restrictive permissions: the kubeconfig is
+          # cluster-admin-equivalent, so it should not be readable by
+          # anything else on the runner.
+          install -m 600 /dev/null $HOME/.kube/config
           echo "${{ secrets.KUBEC_CONFIG_BUILDX }}" > $HOME/.kube/config
+          chmod 600 $HOME/.kube/config
 
       - name: Install kubectl
         run: |
@@ -171,6 +176,10 @@ jobs:
             exit 1
           fi
 
+      - name: Remove the kubeconfig
+        if: always()
+        run: rm -f $HOME/.kube/config
+
       - name: Smoke test the deployed app
         run: |
           # Check the app's own port from inside the pod, AND the Service in