diff --git a/clanServices/zitadel/default.nix b/clanServices/zitadel/default.nix
index c69fcbf..31f0ddb 100644
--- a/clanServices/zitadel/default.nix
+++ b/clanServices/zitadel/default.nix
@@ -42,7 +42,7 @@ in
         clan.core.vars.generators.zitadel = {
           share = false;
 
-          files.masterKey = { deploy = true; secret = true; };
+          files.masterKey = { deploy = true; secret = true; owner = "zitadel"; group = "zitadel"; mode = "0400" };
           files.initialAdminPassword = { deploy = false; secret = false; };
 
           runtimeInputs = with pkgs; [ pwgen ];