diff --git a/hosts/actual/default.nix b/hosts/actual/default.nix
index 3b0a2e5..f0ebb8e 100644
--- a/hosts/actual/default.nix
+++ b/hosts/actual/default.nix
@@ -11,6 +11,9 @@ in
   age.secrets = {
     actual-openid-client-secret = {
       file = ../../secrets/actual-openid-client-secret.age;
+      owner = "actual";
+      group = "actual";
+      mode = "0400";
     };
   };