diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index 65fc235..4f72aef 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -39,6 +39,7 @@ jobs:
     runs-on: nix-darwin
     env:
       CACHE_HOST: ssh-ng://gitea-runner@tako.darksailor.dev
+      CACHE_SIGNING_KEY: /run/secrets/builder/shiro/cache/private
     strategy:
       fail-fast: false
       matrix:
@@ -55,4 +56,7 @@ jobs:
           hb=$!
           trap 'kill $hb 2>/dev/null || true' EXIT
           out=$(nix build .#${{ matrix.flake }} --no-link --print-out-paths --print-build-logs --show-trace)
-          if [ "$GITHUB_REF" = "refs/heads/master" ]; then nix copy --to "$CACHE_HOST" "$out" -j 4; fi
+          if [ "$GITHUB_REF" = "refs/heads/master" ]; then
+            nix store sign --recursive --key-file "$CACHE_SIGNING_KEY" "$out"
+            nix copy --to "$CACHE_HOST" "$out" -j 4
+          fi
diff --git a/darwin/shiro/services/gitea-runner.nix b/darwin/shiro/services/gitea-runner.nix
index 7cf6a73..a4449ee 100644
--- a/darwin/shiro/services/gitea-runner.nix
+++ b/darwin/shiro/services/gitea-runner.nix
@@ -104,7 +104,11 @@ in {
       mode = "0600";
       path = "${runnerHome}/.ssh/id_ed25519";
     };
-    secrets."builder/shiro/cache/private" = {};
+    secrets."builder/shiro/cache/private" = {
+      owner = null;
+      uid = runnerUid;
+      mode = "0400";
+    };
     templates."GITEA_RUNNER_TOKEN.env" = {
       owner = null;
       uid = runnerUid;