diff --git a/dstack/dstack-util/src/main.rs b/dstack/dstack-util/src/main.rs
index 2c2939ea9..e38532336 100644
--- a/dstack/dstack-util/src/main.rs
+++ b/dstack/dstack-util/src/main.rs
@@ -1172,7 +1172,8 @@ fn cmd_tpm_quote(args: TpmQuoteArgs) -> Result<()> {
         serde_json::to_string_pretty(&tpm_quote).context("Failed to serialize TPM quote")?;
 
     if let Some(output_path) = args.output {
-        fs::write(&output_path, quote_json).context("Failed to write quote to file")?;
+        dstack_cli_core::fsutil::write_atomic_mode(&output_path, &quote_json, 0o600)
+            .context("Failed to write quote to file")?;
         eprintln!("TPM quote written to: {:?}", output_path);
     } else {
         println!("{}", quote_json);