diff --git a/hosts/nachtigall/apps/keycloak.nix b/hosts/nachtigall/apps/keycloak.nix
index 5f283105..20ee7ca8 100644
--- a/hosts/nachtigall/apps/keycloak.nix
+++ b/hosts/nachtigall/apps/keycloak.nix
@@ -7,7 +7,7 @@
 }: {
   age.secrets.keycloak-database-password = {
     file = "${flake.self}/secrets/keycloak-database-password.age";
-    mode = "700";
+    mode = "600";
     #owner = "keycloak";
   };