diff --git a/.gitea/workflows/deploy-site.yml b/.gitea/workflows/deploy-site.yml
index 6cb7ea9..66ac30d 100644
--- a/.gitea/workflows/deploy-site.yml
+++ b/.gitea/workflows/deploy-site.yml
@@ -53,7 +53,13 @@ jobs:
             exit 1
           fi
           port=${VPS_PORT:-22}
+          # ssh refuses a config that is group/world-writable or owned by
+          # another user ("Bad owner or permissions on ~/.ssh/config"), which
+          # a runner with a loose umask or a reused HOME produces: create every
+          # file here private and fresh.
+          umask 077
           mkdir -p ~/.ssh && chmod 700 ~/.ssh
+          rm -f ~/.ssh/config
           printf '%s\n' "$VPS_SSH_KEY" | tr -d '\r' > ~/.ssh/deploy_key
           chmod 600 ~/.ssh/deploy_key
           # Fail here, not at the server, when the secret is not a usable key,
@@ -87,6 +93,7 @@ jobs:
             echo "  IdentitiesOnly yes"
             echo "  BatchMode yes"
           } > ~/.ssh/config
+          chmod 600 ~/.ssh/config ~/.ssh/known_hosts
 
       - name: Ensure rsync is available
         run: command -v rsync || (sudo apt-get update && sudo apt-get install -y rsync) || (apt-get update && apt-get install -y rsync)