diff --git a/playbooks/groups/releng-compose.yml b/playbooks/groups/releng-compose.yml
index 3c7c302059..23eb4e625f 100644
--- a/playbooks/groups/releng-compose.yml
+++ b/playbooks/groups/releng-compose.yml
@@ -104,7 +104,7 @@
       dest: /etc/pki/releng
       owner: root
       group: "releng-team"
-      mode: 0640
+      mode: 0600
     when: env == "staging"
 
   - name: place relengpush script for automatic rebuilds