diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh
index ee12eca..706732c 100755
--- a/docker/entrypoint.sh
+++ b/docker/entrypoint.sh
@@ -40,7 +40,7 @@ if [[ ! "$max_connections" =~ ^[1-9][0-9]*$ ]]; then
 fi
 
 install -d -o root -g root -m 0700 /data/mtproxy
-install -d -o tproxy -g tproxy -m 0700 /data/tproxy /run/tproxy
+install -d -o root -g tproxy -m 0750 /data/tproxy /run/tproxy
 
 atomic_download() {
 	local url=$1 destination=$2 minimum_size=$3 required_pattern=$4 temporary
@@ -75,12 +75,16 @@ fi
 chown root:root /data/client-secret
 chmod 0600 /data/client-secret
 
+if [[ -e /data/tproxy/token.key ]]; then
+	chown root:root /data/tproxy/token.key
+fi
 if [[ ! -s /data/tproxy/token.key ]]; then
 	head -c 32 /dev/urandom > /data/tproxy/token.key
 fi
-chown tproxy:tproxy /data/tproxy/token.key
 chmod 0400 /data/tproxy/token.key
+chown tproxy:tproxy /data/tproxy/token.key
 
+rm -f /data/tproxy/config.json /run/tproxy/profiles.json
 cat > /data/tproxy/config.json <<JSON
 {
   "public_hostname": "$hostname_value",
@@ -99,8 +103,8 @@ cat > /run/tproxy/profiles.json <<JSON
 {"profiles":[{"name":"default","secret":"$client_secret","backend":"127.0.0.1:2398","carrier_mode":"websocket"}]}
 JSON
 
-chown tproxy:tproxy /data/tproxy/config.json /run/tproxy/profiles.json
 chmod 0400 /data/tproxy/config.json /run/tproxy/profiles.json
+chown tproxy:tproxy /data/tproxy/config.json /run/tproxy/profiles.json
 
 runuser -u tproxy -- /usr/local/bin/tproxy-server \
 	-config /data/tproxy/config.json \