diff --git a/home.admin/_bootstrap.sh b/home.admin/_bootstrap.sh
index e5c245560..8a4926521 100755
--- a/home.admin/_bootstrap.sh
+++ b/home.admin/_bootstrap.sh
@@ -483,11 +483,6 @@ if [ ${isMounted} -eq 0 ]; then
     sudo cp /var/cache/raspiblitz/temp/raspiblitz.conf ${configFile}
   fi
 
-  # everyone can read the config but it can only be
-  # edited/written by root ot admin user (part of group sudo)
-  sudo chown root:sudo ${configFile}
-  sudo chmod 664 ${configFile}
-
   # kick-off provision process
   sed -i "s/^state=.*/state=provision/g" ${infoFile}
   sed -i "s/^message=.*/message='Starting Provision'/g" ${infoFile}
@@ -572,6 +567,11 @@ if [ ${isMounted} -eq 0 ]; then
     exit 1
   fi
 
+  # everyone can read the config but it can only be
+  # edited/written by root ot admin user (part of group sudo)
+  sudo chown root:sudo ${configFile}
+  sudo chmod 664 ${configFile}
+
   # unlock lnd if needed
   source ${setupFile}
   echo "checking Unlock ..." >> $logFile
diff --git a/home.admin/config.scripts/blitz.migration.sh b/home.admin/config.scripts/blitz.migration.sh
index 9b1f9cd02..e50a7b433 100755
--- a/home.admin/config.scripts/blitz.migration.sh
+++ b/home.admin/config.scripts/blitz.migration.sh
@@ -89,8 +89,8 @@ migrate_raspiblitz_conf () {
   echo "lcdrotate=1" >> /home/admin/raspiblitz.conf
   echo "runBehindTor=on" >> /home/admin/raspiblitz.conf
   sudo mv /home/admin/raspiblitz.conf /mnt/hdd/raspiblitz.conf
-  sudo chown root:root /mnt/hdd/raspiblitz.conf
-  sudo chmod 777 /mnt/hdd/raspiblitz.conf
+  sudo chown root:sudo /mnt/hdd/raspiblitz.conf
+  sudo chmod 664 /mnt/hdd/raspiblitz.conf
 
   # rename ext4 data drive
   sudo e2label /dev/sda1 BLOCKCHAIN