diff --git a/ansible/roles/ingress/tasks/firewall.yml b/ansible/roles/ingress/tasks/firewall.yml
index 10a35f4..e3ef0f4 100644
--- a/ansible/roles/ingress/tasks/firewall.yml
+++ b/ansible/roles/ingress/tasks/firewall.yml
@@ -8,6 +8,7 @@
     src: files/nftables.conf
     dest: /etc/nftables.conf
     validate: nft -c -f %s
+    mode: "644"
   become: true
   notify: reload nftables