diff --git a/playbooks/groups/releng-compose.yml b/playbooks/groups/releng-compose.yml
index ef47bbca4a..8d00dfa373 100644
--- a/playbooks/groups/releng-compose.yml
+++ b/playbooks/groups/releng-compose.yml
@@ -93,12 +93,18 @@
     copy:
       src: "{{private}}/files/keytabs/{{env}}/releng"
       dest: /etc/krb5.releng.keytab
+      owner: root
+      group: "releng-team"
+      mode: 0640
     when: env == "staging"
 
   - name: copy releng ssh key for rebuild fedpkg/distgit pushes
     copy:
       src: "{{private}}/files/releng/sshkeys/container-rebuild-staging"
       dest: /etc/pki/releng
+      owner: root
+      group: "releng-team"
+      mode: 0640
     when: env == "staging"