diff --git a/tasks/setup.yml b/tasks/setup.yml
index a738a7a..cc375a5 100644
--- a/tasks/setup.yml
+++ b/tasks/setup.yml
@@ -4,18 +4,21 @@
       template:
         src: etc/sysconfig/renovate.j2
         dest: /etc/sysconfig/renovate
+        mode: 0600
       notify: __renovate_restart
 
     - name: Write timer file
       template:
         src: etc/systemd/system/renovate.timer.j2
         dest: /etc/systemd/system/renovate.timer
+        mode: 0644
       notify: __renovate_restart
 
     - name: Write service file
       template:
         src: etc/systemd/system/renovate.service.j2
         dest: /etc/systemd/system/renovate.service
+        mode: 0644
       notify: __renovate_restart
 
     - name: Ensure renovatebot timer is up and running