diff --git a/default.nix b/default.nix
index f7340ed..f4509b8 100644
--- a/default.nix
+++ b/default.nix
@@ -53,7 +53,7 @@ in {
         sopsFile = config.xin-secrets.deploy;
         owner = "root";
         group = "wheel";
-        mode = "440";
+        mode = "400";
       };
     };