diff --git a/tasks/main.yml b/tasks/main.yml
index 6df448cf920fd11d3b2cd0a5471df94a2502ece8..183738c75fac6dd2ae730679c82d12ed451d3faf 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -55,6 +55,7 @@
   template:
     src: config.yaml.j2
     dest: /etc/borgmatic/config.yaml
+    mode: 0600
 
 - name: Add borgbackup service
   copy: