diff --git a/pkg/build/build.go b/pkg/build/build.go
index d9f7a771..b51f1f78 100644
--- a/pkg/build/build.go
+++ b/pkg/build/build.go
@@ -7,6 +7,7 @@ package build
 import (
 	"bytes"
 	"fmt"
+	"os"
 	"path/filepath"
 	"regexp"
 	"strings"
@@ -65,6 +66,11 @@ func Image(params *Params) (string, error) {
 	if err != nil {
 		return "", extractRootCause(err, params.TargetOS, params.KernelDir)
 	}
+	if key := filepath.Join(params.OutputDir, "key"); osutil.IsExist(key) {
+		if err := os.Chmod(key, 0600); err != nil {
+			return "", fmt.Errorf("failed to chmod 0600 %v: %v", key, err)
+		}
+	}
 	sign := ""
 	if signer, ok := builder.(signer); ok {
 		sign, err = signer.sign(params)