diff --git a/bootstrap.sh.tmpl b/bootstrap.sh.tmpl
index 5a4245e..979bcfa 100755
--- a/bootstrap.sh.tmpl
+++ b/bootstrap.sh.tmpl
@@ -30,6 +30,7 @@ pillar_roots:
 log_file: file:///dev/log
 EOF
 
+umask 077
 cat >/etc/salt/grains <<EOF
 roles:
 # TODO: fill real roles
diff --git a/states/base/init.sls b/states/base/init.sls
index 15ec54f..1b665e9 100644
--- a/states/base/init.sls
+++ b/states/base/init.sls
@@ -11,6 +11,13 @@ base-packages:
       - git
       - locales-all
 
+/etc/salt/grains:
+  file.managed:
+    - user: root
+    - group: root
+    - mode: 0600
+    - replace: False
+
 /home/vagrant/.screenrc:
   file.managed:
     - user: vagrant