diff --git a/nix/host-modules/swarm-bao.nix b/nix/host-modules/swarm-bao.nix
index 459934f3..05daa859 100644
--- a/nix/host-modules/swarm-bao.nix
+++ b/nix/host-modules/swarm-bao.nix
@@ -2595,6 +2595,9 @@ in
               };
               script = ''
                 set -euo pipefail
+
+                ${atomicWriteSecret}
+
                 install -d -m 0770 -g ${tokenGroup} ${tokenStoreDir}
                 # Required whenever the store is not at its default location, or the
                 # library cannot find the token the seal asks for.
@@ -2644,8 +2647,7 @@ in
                 chgrp ${tokenGroup} ${tokenStoreDir}/tpm2_pkcs11.sqlite3
                 chmod 0660 ${tokenStoreDir}/tpm2_pkcs11.sqlite3
 
-                ( umask 077; printf 'BAO_HSM_PIN=%s\n' "$(cat ${tokenStoreDir}/user-pin)" > ${pinEnvFile} )
-                chmod 0400 ${pinEnvFile}
+                printf 'BAO_HSM_PIN=%s\n' "$(cat ${tokenStoreDir}/user-pin)" | atomic_write_secret 0400 "" ${pinEnvFile}
               '';
             };