diff --git a/rsyncd/config.sls b/rsyncd/config.sls
index 435bd88..3a0ad50 100644
--- a/rsyncd/config.sls
+++ b/rsyncd/config.sls
@@ -16,5 +16,6 @@ rsyncd_secrets_file:
     - watch_in:
       - service: rsync
     - source: salt://rsyncd/files/secrets.jinja
+    - mode: 640
     - template: jinja
 {% endif %}