diff --git a/roles/jenkins/master/tasks/main.yml b/roles/jenkins/master/tasks/main.yml
index 226d321c69..b4a07d7126 100644
--- a/roles/jenkins/master/tasks/main.yml
+++ b/roles/jenkins/master/tasks/main.yml
@@ -65,6 +65,13 @@
   - jenkins/master
   - config
 
+- name: set /var/log/jenkins to not be writable by jenkins group
+  file: path=/var/log/jenkins mode=0700 owner=jenkins
+  tags:
+  - jenkins
+  - jenkins/master
+  - config
+
 - name: install jenkins launcher config file
   copy: >
     src="jenkins.conf"