diff --git a/tasks/setup.yml b/tasks/setup.yml
index 2b87866..fca16f8 100644
--- a/tasks/setup.yml
+++ b/tasks/setup.yml
@@ -19,6 +19,7 @@
     - name: Add .autorelabel file (requires a reboot)
       file:
         path: /.autorelabel
+        mode: 0600
         state: touch
       when:
         - selinux_state == "enforcing"