diff --git a/roles/fedimg/tasks/main.yml b/roles/fedimg/tasks/main.yml
index b18f54fd0f..fb8f1029d7 100644
--- a/roles/fedimg/tasks/main.yml
+++ b/roles/fedimg/tasks/main.yml
@@ -63,7 +63,7 @@
 
 - name: copy keys into pki directory for production
   copy: src={{private}}/files/fedimg/{{item}} dest=/etc/pki/fedimg/{{item}}
-        owner=fedmsg group=fedmsg mode=0100
+        owner=fedmsg group=fedmsg mode=0400
   with_items:
   - fedimg-prod
   - fedimg-prod.pub