diff --git a/plugins/gpg-agent/gpg-agent.plugin.zsh b/plugins/gpg-agent/gpg-agent.plugin.zsh
index 8cc71fd57..63c433413 100644
--- a/plugins/gpg-agent/gpg-agent.plugin.zsh
+++ b/plugins/gpg-agent/gpg-agent.plugin.zsh
@@ -1,26 +1,31 @@
-# Based on ssh-agent code
-
 local GPG_ENV=$HOME/.gnupg/gpg-agent.env
 
-function start_agent {
-  /usr/bin/env gpg-agent --daemon --enable-ssh-support --write-env-file ${GPG_ENV} > /dev/null
-  chmod 600 ${GPG_ENV}
-  . ${GPG_ENV} > /dev/null
+function start_agent_nossh {
+    eval $(/usr/bin/env gpg-agent --daemon --write-env-file ${GPG_ENV}) > /dev/null
+    export GPG_AGENT_INFO
 }
 
-# Source GPG agent settings, if applicable
+function start_agent_withssh {
+    eval $(/usr/bin/env gpg-agent --daemon --enable-ssh-support --write-env-file ${GPG_ENV}) > /dev/null
+    export GPG_AGENT_INFO
+    export SSH_AUTH_SOCK
+    export SSH_AGENT_PID
+}
+
+# make sure all created files are u=rw only
+umask 177
+
+# source settings of old agent, if applicable
 if [ -f "${GPG_ENV}" ]; then
   . ${GPG_ENV} > /dev/null
-  ps -ef | grep ${SSH_AGENT_PID} | grep gpg-agent > /dev/null || {
-    start_agent;
-  }
-else
-  start_agent;
 fi
 
-export GPG_AGENT_INFO
-export SSH_AUTH_SOCK
-export SSH_AGENT_PID
+# check for existing ssh-agent
+if ssh-add -l > /dev/null 2> /dev/null; then
+    start_agent_nossh;
+else
+    start_agent_withssh;
+fi
 
 GPG_TTY=$(tty)
 export GPG_TTY