diff --git a/tasks/osbs_certs.yml b/tasks/osbs_certs.yml
index e6f4e5b62f..58bea79506 100644
--- a/tasks/osbs_certs.yml
+++ b/tasks/osbs_certs.yml
@@ -4,6 +4,8 @@
   copy:
     src: "{{private}}/files/osbs/osbs-dev.certs/osbs-dev.fedorainfracloud.org.crt"
     dest: "/etc/pki/ca-trust/source/anchors/osbs-dev.fedorainfracloud.org.crt"
+    owner: root
+    mode: 0400
   when: env == "staging"
   notify:
     - update ca trust