diff --git a/roles/koschei/tasks/main.yml b/roles/koschei/tasks/main.yml
index 55dac40688..7b8b878042 100644
--- a/roles/koschei/tasks/main.yml
+++ b/roles/koschei/tasks/main.yml
@@ -10,6 +10,9 @@
   template: >
     src="config.cfg.j2"
     dest="/etc/koschei/config.cfg"
+    owner=koschei
+    group=koschei
+    mode=0400
   notify:
   - restart koschei-polling
   - restart koschei-resolver