diff --git a/lib/db.func b/lib/db.func
index f6d3a71..58e619a 100644
--- a/lib/db.func
+++ b/lib/db.func
@@ -458,7 +458,7 @@ setup_mariadb_db() {
     echo "User: $MARIADB_DB_USER"
     echo "Password: $MARIADB_DB_PASS"
   } >>"$CREDS_FILE"
-  chmod 600 "$CREDS_FILE"
+  [[ -f "$CREDS_FILE" ]] && chmod 600 "$CREDS_FILE"
 
   msg_ok "Set up MariaDB Database"
 
@@ -515,7 +515,7 @@ setup_mysql_db() {
     echo "User: $MYSQL_DB_USER"
     echo "Password: $MYSQL_DB_PASS"
   } >>"$CREDS_FILE"
-  chmod 600 "$CREDS_FILE"
+  [[ -f "$CREDS_FILE" ]] && chmod 600 "$CREDS_FILE"
 
   msg_ok "Set up MySQL Database"
 
@@ -1584,7 +1584,7 @@ setup_postgresql_db() {
     echo "User: $PG_DB_USER"
     echo "Password: $PG_DB_PASS"
   } >>"$CREDS_FILE"
-  chmod 600 "$CREDS_FILE"
+  [[ -f "$CREDS_FILE" ]] && chmod 600 "$CREDS_FILE"
 
   msg_ok "Set up PostgreSQL Database"
 
diff --git a/tests/db-helper-context.sh b/tests/db-helper-context.sh
index 47daba8..ae99467 100644
--- a/tests/db-helper-context.sh
+++ b/tests/db-helper-context.sh
@@ -57,5 +57,18 @@ for db in postgresql mariadb mysql; do
   check "$db: runs without APPLICATION, alphanumeric password, creds named after APP and private" "alnum24 pgadmin.creds 600" "$(umask 022; run "$db")"
 done
 
+# Scripts suppress the file with PG_DB_CREDS_FILE=/dev/null; chmod 600 on it would
+# lock every non-root process out of /dev/null.
+devnull_chmods() {
+  (
+    chmod() { echo "chmod $*" >>"$TEST_DIR/chmod.log"; }
+    HOME="$TEST_DIR"
+    APP="demo"
+    PG_DB_NAME=appdb PG_DB_USER=appuser PG_DB_CREDS_FILE=/dev/null setup_postgresql_db >/dev/null 2>&1
+  )
+  grep -c '/dev/null' "$TEST_DIR/chmod.log" 2>/dev/null || echo 0
+}
+check "PG_DB_CREDS_FILE=/dev/null is never chmodded" "0" "$(devnull_chmods)"
+
 echo "${passed} passed, ${failed} failed"
 [[ "$failed" -eq 0 ]]