diff --git a/scripts/setup.sh b/scripts/setup.sh
index 11d81ad..94769ae 100755
--- a/scripts/setup.sh
+++ b/scripts/setup.sh
@@ -70,6 +70,7 @@ if [[ -f $HOME/.ssh/config ]] && grep -q '^Include ~/mac/config/ssh_homelab' "$H
   { echo 'Include ~/mac/config/ssh_homelab'; [[ -f $HOME/.ssh/config ]] && cat "$HOME/.ssh/config"; } > "$HOME/.ssh/config.new"
   mv "$HOME/.ssh/config.new" "$HOME/.ssh/config"; chmod 600 "$HOME/.ssh/config"; log set "ssh config include"; CHANGED=1
 fi
+chmod 600 "$REPO/config/ssh_homelab" 2>/dev/null || true   # ssh refuses a group/world-writable Include target
 ssh-keygen -F 192.168.0.173 >/dev/null || { ssh-keyscan -t ed25519 192.168.0.173 >> "$HOME/.ssh/known_hosts" 2>/dev/null; log set "known_hosts += pve173"; }
 
 # ---------- defaults: Linux feel ----------