diff --git a/bin/netvm-node-up.sh b/bin/netvm-node-up.sh
index 3171bed..421dbd9 100755
--- a/bin/netvm-node-up.sh
+++ b/bin/netvm-node-up.sh
@@ -8,6 +8,8 @@ netvm_names "${1:?usage: netvm-node-up.sh <node>}"
 CONF="/etc/netvm/${NODE}.conf"
 [ -f "$CONF" ] || { echo "missing $CONF (human: netvm-new-identity.sh $NODE)"; exit 1; }
 chmod 600 "$CONF"
+# let the operator user stat (not read) identities: 711 dir, 600 files
+chmod 711 /etc/netvm 2>/dev/null || true
 nsexec() { ip netns exec "$NETNS" "$@"; }
 
 ip netns add "$NETNS" 2>/dev/null || true
diff --git a/bin/netvm-provision-edge.sh b/bin/netvm-provision-edge.sh
index a9974e4..68480f8 100755
--- a/bin/netvm-provision-edge.sh
+++ b/bin/netvm-provision-edge.sh
@@ -41,7 +41,7 @@ sudo visudo -c -f "$SUDOERS_FILE" > /dev/null && echo "ok: sudoers valid"
 
 # 4. dir for human-placed WireGuard identities
 sudo mkdir -p /etc/netvm
-sudo chmod 700 /etc/netvm
+sudo chmod 711 /etc/netvm
 echo "ok: /etc/netvm ready"
 
 # 5. tailnet check