diff --git a/tasks/provision.yml b/tasks/provision.yml
index 8602c3c..ee935ea 100644
--- a/tasks/provision.yml
+++ b/tasks/provision.yml
@@ -89,6 +89,7 @@
     src: "{{ consensus_secrets_file }}"
     dest: "{{ configuration_directory }}/consensus_secrets.yaml"
     decrypt: yes
+    mode: '0600'
 
 - name: Run docker-compose without monitoring
   when: not enable_monitoring