diff --git a/install/gitea-install.sh b/install/gitea-install.sh
index f4c38d784..cabea2583 100644
--- a/install/gitea-install.sh
+++ b/install/gitea-install.sh
@@ -30,8 +30,12 @@ setup_deb_based() {
   chown -R gitea:gitea /var/lib/gitea/
   chmod -R 750 /var/lib/gitea/
   chown root:gitea /etc/gitea
-  chmod 750 /etc/gitea
+  chmod 770 /etc/gitea
   sudo -u gitea ln -s /var/lib/gitea/data/.ssh/ /etc/gitea/.ssh
+  # sshd's StrictModes rejects pubkey auth if authorized_keys or any parent dir up to
+  # $HOME is group-writable, so 770 can only be transient - tighten it once the gitea
+  # user no longer needs group-write to create the symlink above.
+  chmod 750 /etc/gitea
   msg_ok "Configured Gitea"
 
   msg_info "Creating Service"