diff --git a/agent/agent.go b/agent/agent.go
index dca7bf9487397..9657a1fec5888 100644
--- a/agent/agent.go
+++ b/agent/agent.go
@@ -31,6 +31,7 @@ import (
 	"github.com/hashicorp/hcp-scada-provider/capability"
 	"github.com/hashicorp/raft"
 	"github.com/hashicorp/serf/serf"
+	"github.com/rboyer/safeio"
 	"golang.org/x/net/http2"
 	"golang.org/x/net/http2/h2c"
 	"google.golang.org/grpc"
@@ -4668,7 +4669,12 @@ func (a *Agent) persistServerMetadata() {
 				continue
 			}
 
-			f.Close()
+			sf := f.(*safeio.File)
+			if err := sf.Commit(); err != nil {
+				a.logger.Error("failed to commit server metadata", "error", err)
+				continue
+			}
+			sf.Close()
 		case <-a.shutdownCh:
 			return
 		}
diff --git a/agent/consul/server_metadata.go b/agent/consul/server_metadata.go
index 3ee706ba49648..b9a4eaf2eb390 100644
--- a/agent/consul/server_metadata.go
+++ b/agent/consul/server_metadata.go
@@ -8,6 +8,8 @@ import (
 	"io"
 	"os"
 	"time"
+
+	"github.com/rboyer/safeio"
 )
 
 // ServerMetadataFile is the name of the file on disk that server metadata
@@ -31,7 +33,7 @@ func (md *ServerMetadata) IsLastSeenStale(d time.Duration) bool {
 // OpenServerMetadata is a helper function for opening the server metadata file
 // with the correct permissions.
 func OpenServerMetadata(filename string) (io.WriteCloser, error) {
-	return os.OpenFile(filename, os.O_WRONLY|os.O_CREATE, 0600)
+	return safeio.OpenFile(filename, 0600)
 }
 
 type ServerMetadataReadFunc func(filename string) (*ServerMetadata, error)