diff --git a/bash/ensure-ssh-agent b/bash/ensure-ssh-agent
index a653c26..32b8d9a 100644
--- a/bash/ensure-ssh-agent
+++ b/bash/ensure-ssh-agent
@@ -1,14 +1,26 @@
 #!/usr/bin/env bash
 
-ENVFILE="${XDG_RUNTIME_DIR:-$XDG_DATA_HOME}/ssh-agent.env"
+function tmp-if-needed {
+  tmpdir=/tmp/ssh-env-$(whoami)
+  [[ -d $tmpdir ]] || mkdir $tmpdir
+  chmod 700 "$tmpdir"
+  chown $(whoami) "$tmpdir"
+  echo $tmpdir
+}
+
+ENVFILE="${XDG_RUNTIME_DIR:-$(tmp-if-needed)}/ssh-agent.env"
 
 if [ -f $ENVFILE ] ; then
     . $ENVFILE > /dev/null
     if ! kill -0 $SSH_AGENT_PID > /dev/null 2>&1; then
         eval $(ssh-agent | tee $ENVFILE)
+        chmod 700 "$ENVFILE"
+        chown $(whoami) "$ENVFILE"
         ssh-add
     fi
 else
     eval $(ssh-agent | tee $ENVFILE)
+    chmod 700 "$ENVFILE"
+    chown $(whoami) "$ENVFILE"
     ssh-add
 fi