diff --git a/plugins/config/config_test.go b/plugins/config/config_test.go
index 02df8d9bc..e512fc42c 100644
--- a/plugins/config/config_test.go
+++ b/plugins/config/config_test.go
@@ -13,7 +13,9 @@ import (
 
 var (
 	testAppName      = "test-app-1"
+	dokkuRoot        = common.MustGetEnv("DOKKU_ROOT")
 	dokkuLibRoot     = common.MustGetEnv("DOKKU_LIB_ROOT")
+	testAppRoot      = filepath.Join(dokkuRoot, testAppName)
 	testAppDir       = filepath.Join(dokkuLibRoot, "config", testAppName)
 	globalConfigFile = filepath.Join(dokkuLibRoot, "config", "--global", "ENV")
 )
@@ -27,12 +29,14 @@ func setupTests() (err error) {
 }
 
 func setupTestApp() (err error) {
+	Expect(os.MkdirAll(testAppRoot, 0766)).To(Succeed())
 	Expect(os.MkdirAll(testAppDir, 0766)).To(Succeed())
 	b := []byte("export testKey=TESTING\n")
 	if err = os.WriteFile(strings.Join([]string{testAppDir, "/ENV"}, ""), b, 0644); err != nil {
 		return
 	}
 
+	Expect(os.MkdirAll(filepath.Dir(globalConfigFile), 0766)).To(Succeed())
 	b = []byte("export testKey=GLOBAL_TESTING\nexport globalKey=GLOBAL_VALUE")
 	if err = os.WriteFile(globalConfigFile, b, 0644); err != nil {
 		return
@@ -41,6 +45,7 @@ func setupTestApp() (err error) {
 }
 
 func teardownTestApp() {
+	os.RemoveAll(testAppRoot)
 	os.RemoveAll(testAppDir)
 }
 
diff --git a/plugins/config/triggers.go b/plugins/config/triggers.go
index 02edcb160..724aa348d 100644
--- a/plugins/config/triggers.go
+++ b/plugins/config/triggers.go
@@ -103,6 +103,13 @@ func migrateGlobalEnv() error {
 		return fmt.Errorf("Unable to write global environment: %s", err.Error())
 	}
 
+	if err := common.SetPermissions(common.SetPermissionInput{
+		Filename: globalEnv.Filename(),
+		Mode:     os.FileMode(0600),
+	}); err != nil {
+		return fmt.Errorf("Unable to set permissions on global environment: %s", err.Error())
+	}
+
 	if err := common.PropertyWrite("config", "--global", "env-migrated", "true"); err != nil {
 		return fmt.Errorf("Unable to set env-migrated property: %s", err.Error())
 	}