diff --git a/xkb.cpp b/xkb.cpp
--- a/xkb.cpp
+++ b/xkb.cpp
@@ -294,25 +294,28 @@
     }
     const uint size = qstrlen(keymapString.data()) + 1;
 
-    QTemporaryFile *tmp = new QTemporaryFile(this);
+    QScopedPointer<QTemporaryFile> tmp(new QTemporaryFile);
     if (!tmp->open()) {
-        delete tmp;
         return;
     }
-    unlink(tmp->fileName().toUtf8().constData());
     if (!tmp->resize(size)) {
-        delete tmp;
         return;
     }
     uchar *address = tmp->map(0, size);
     if (!address) {
         return;
     }
     if (qstrncpy(reinterpret_cast<char*>(address), keymapString.data(), size) == nullptr) {
-        delete tmp;
         return;
     }
-    m_seat->setKeymap(tmp->handle(), size);
+    tmp->setPermissions(QFileDevice::ReadOwner);
+
+    QFile *readOnlyTemp = new QFile(tmp->fileName(), this);
+    if (!readOnlyTemp->open(QFileDevice::ReadOnly)) {
+        return;
+    }
+    tmp.reset(); // unlink before sending to clients so they have no chance to set permissions back
+    m_seat->setKeymap(readOnlyTemp->handle(), size);
 }
 
 void Xkb::updateModifiers(uint32_t modsDepressed, uint32_t modsLatched, uint32_t modsLocked, uint32_t group)