diff --git a/services/lldap/default.nix b/services/lldap/default.nix
index 552c5a8..2dce8c3 100644
--- a/services/lldap/default.nix
+++ b/services/lldap/default.nix
@@ -6,6 +6,7 @@
     sopsFile = ../../secrets/auth01/secrets.yaml;
     restartUnits = [ "lldap.service" ];
     group = "acme";
+    mode = "0440";
   };
 
   services.lldap = {