diff --git a/build/package/winget/Tgstation.Server.Host.Service.Configure/Program.cs b/build/package/winget/Tgstation.Server.Host.Service.Configure/Program.cs
index 0739060cfe..13b2ae64c3 100644
--- a/build/package/winget/Tgstation.Server.Host.Service.Configure/Program.cs
+++ b/build/package/winget/Tgstation.Server.Host.Service.Configure/Program.cs
@@ -3,6 +3,7 @@ using System.Diagnostics;
 using System.IO;
 using System.Linq;
 using System.Reflection;
+using System.Security.AccessControl;
 using System.Threading;
 
 using var process = new Process();
@@ -57,14 +58,27 @@ foreach (var installLogFile in Directory.EnumerateFiles(installDir, "*.log"))
 	File.Delete(installLogFile);
 
 if (uninstall)
-{
 	Directory.Delete(
 		Path.Combine(installDir, "lib"),
 		true);
-}
 
 if ((shortcut || (interactive && !uninstall)) && process.ExitCode == 0)
 {
+	// try and lockdown the appsettings file
+	var fileInfo = new FileInfo("appsettings.Production.yml");
+
+	//get security access
+	FileSecurity fs = fileInfo.GetAccessControl();
+
+	//remove inherited access
+	fs.SetAccessRuleProtection(true, false);
+
+	// Explicitly grant admins and SYSTEM
+	fs.AddAccessRule(new FileSystemAccessRule("Administrators", FileSystemRights.FullControl, AccessControlType.Allow));
+	fs.AddAccessRule(new FileSystemAccessRule("SYSTEM", FileSystemRights.Read, AccessControlType.Allow));
+
+	fileInfo.SetAccessControl(fs);
+
 	var startServer = interactive;
 	if (shortcut)
 	{