diff --git a/cookbooks/vault/setup.rb b/cookbooks/vault/setup.rb
index 6ae000d..bb04ddb 100644
--- a/cookbooks/vault/setup.rb
+++ b/cookbooks/vault/setup.rb
@@ -2,7 +2,7 @@
 template '/etc/vault.d/vault.hcl' do
   owner 'vault'
   group 'vault'
-  mode '644'
+  mode '600'
 
   variables(HOSTNAME: node['vault']['hostname'],  IPADDR: node['vault']['ipaddr'], IPS: node['vault']['ips'])
 end