diff --git a/roles/server/tasks/utilities/wireguard.yml b/roles/server/tasks/utilities/wireguard.yml
index 97320e8..6aef0c0 100644
--- a/roles/server/tasks/utilities/wireguard.yml
+++ b/roles/server/tasks/utilities/wireguard.yml
@@ -16,6 +16,7 @@
   copy:
     content: "{{ item.key }}"
     dest: "{{ item.keyfile }}"
+    mode: '0600'
   loop:
     - { key: wg_pubkey, keyfile: "/etc/wireguard/publickey" }
     - { key: wg_privkey, keyfile: "/etc/wireguard/privatekey" }