diff --git a/tasks/install.yml b/tasks/install.yml
index d58aeae..1bc24ee 100644
--- a/tasks/install.yml
+++ b/tasks/install.yml
@@ -36,6 +36,7 @@
       template:
         src: config/cli.ini.j2
         dest: "{{ certbot_config_dir }}/cli.ini"
+        mode: 0640
 
     - name: Deploy credentials file
       template: