diff --git a/internal/config/jsonstore.go b/internal/config/jsonstore.go
index 247707ea..abcbcef5 100644
--- a/internal/config/jsonstore.go
+++ b/internal/config/jsonstore.go
@@ -33,8 +33,7 @@ func (f *JsonFileStore) Get() (*v1.Config, error) {
 	}
 
 	var config v1.Config
-
-	if err = protojson.Unmarshal(data, &config); err != nil {
+	if err = (protojson.UnmarshalOptions{DiscardUnknown: true}).Unmarshal(data, &config); err != nil {
 		return nil, fmt.Errorf("failed to unmarshal config: %w", err)
 	}
 
@@ -72,5 +71,10 @@ func (f *JsonFileStore) Update(config *v1.Config) error {
 		return fmt.Errorf("failed to write config file: %w", err)
 	}
 
+	// only the user running backrest should be able to read the config.
+	if err := os.Chmod(f.Path, 0600); err != nil {
+		return fmt.Errorf("chmod(0600) config file: %w", err)
+	}
+
 	return nil
 }