diff --git a/gensignkey.c b/gensignkey.c
index 8317feaf1..34b6f5a29 100644
--- a/gensignkey.c
+++ b/gensignkey.c
@@ -152,6 +152,10 @@ int signkey_generate(enum signkey_type keytype, int bits, const char* filename,
 		}
 	}
 
+	/* ensure directory update is flushed to disk, otherwise we can end up
+	with zero-byte hostkey files if the power goes off */
+	fsync_parent_dir(filename);
+
 out:
 	if (buf) {
 		buf_burn(buf);