diff --git a/nixos/base/nix.nix b/nixos/base/nix.nix
index 26b962a8..072901de 100644
--- a/nixos/base/nix.nix
+++ b/nixos/base/nix.nix
@@ -77,7 +77,7 @@ in {
     }.secrets.github-access-token-public = {
       sopsFile = mkDefault ../secrets/nix.yaml;
       group = mkDefault "users";
-      mode = mkDefault "0644";
+      mode = mkDefault "0640";
     };
   };
 }