diff --git a/nixos/pruflas/configuration.nix b/nixos/pruflas/configuration.nix
index d96bfdf..20d9f53 100644
--- a/nixos/pruflas/configuration.nix
+++ b/nixos/pruflas/configuration.nix
@@ -20,6 +20,7 @@ in
 
   age.secrets.${hydraGitHubAuth} = {
     file = "${secretsPath}/${hydraGitHubAuth}.age";
+    mode = "440";
     owner = "hydra-www";
     group = "hydra";
   };