diff --git a/roles/ansible-pull/tasks/main.yml b/roles/ansible-pull/tasks/main.yml
index ff9b972..5284e00 100644
--- a/roles/ansible-pull/tasks/main.yml
+++ b/roles/ansible-pull/tasks/main.yml
@@ -8,9 +8,9 @@
   pip: name=ansible<5,ansible-lint state=latest
   when: ansible_os_family != "Gentoo"
 - name: configure systemd service
-  template: src=ansible-pull.service dest=/etc/systemd/system/ansible-pull.service
+  template: src=ansible-pull.service dest=/etc/systemd/system/ansible-pull.service mode=0644
 - name: configure systemd timer
-  template: src=ansible-pull.timer dest=/etc/systemd/system/ansible-pull.timer
+  template: src=ansible-pull.timer dest=/etc/systemd/system/ansible-pull.timer mode=0644
   notify: restart ansiblepull timer
 - name: enable timer
   systemd: daemon_reload=yes name=ansible-pull.timer enabled=yes state=started
diff --git a/roles/backup/tasks/main.yml b/roles/backup/tasks/main.yml
index 1cdb070..2460bdd 100644
--- a/roles/backup/tasks/main.yml
+++ b/roles/backup/tasks/main.yml
@@ -4,9 +4,9 @@
 - name: template out backup script
   template: src={{ backup_script }}.sh dest=/opt/backup.sh mode=0700 owner=root group=root
 - name: configure systemd service
-  template: src=backup.service dest=/etc/systemd/system/backup.service
+  template: src=backup.service dest=/etc/systemd/system/backup.service mode=0644
 - name: configure systemd timer
-  template: src=backup.timer dest=/etc/systemd/system/backup.timer
+  template: src=backup.timer dest=/etc/systemd/system/backup.timer mode=0644
   notify: restart backup timer
 - name: enable timer
   systemd: name=backup.timer state=started enabled=yes daemon_reload=yes
diff --git a/roles/common/tasks/system.yml b/roles/common/tasks/system.yml
index f9319dc..2793440 100644
--- a/roles/common/tasks/system.yml
+++ b/roles/common/tasks/system.yml
@@ -8,4 +8,4 @@
   timezone: name=America/Chicago
   notify: restart cron
 - name: configure shell profile
-  template: src=profile.sh dest=/etc/profile.d/50-ansible.sh
+  template: src=profile.sh dest=/etc/profile.d/50-ansible.sh mode=0644
diff --git a/roles/desktop/tasks/main.yml b/roles/desktop/tasks/main.yml
index 4bff489..dd7b1e6 100644
--- a/roles/desktop/tasks/main.yml
+++ b/roles/desktop/tasks/main.yml
@@ -2,9 +2,9 @@
 # vim:ft=ansible:
 ---
 - name: assure xorg.conf.d
-  file: path=/etc/X11/xorg.conf.d state=directory
+  file: path=/etc/X11/xorg.conf.d state=directory mode=0755
 - name: configure X misc
-  template: src={{ item }} dest=/etc/X11/xorg.conf.d/{{ item }}
+  template: src={{ item }} dest=/etc/X11/xorg.conf.d/{{ item }} mode=0644
   loop:
       # Disables mouse acceleration on all mouse peripherals
     - 90-mouse-acceleration.conf
diff --git a/roles/udev/tasks/main.yml b/roles/udev/tasks/main.yml
index ddd969b..7ee92d0 100644
--- a/roles/udev/tasks/main.yml
+++ b/roles/udev/tasks/main.yml
@@ -2,6 +2,6 @@
 # vim:ft=ansible:
 ---
 - name: configure udev rules
-  lineinfile: path=/etc/udev/rules.d/50-ansible.rules line={{ item }} create=yes
+  lineinfile: path=/etc/udev/rules.d/50-ansible.rules line={{ item }} create=yes mode=0644
   loop: "{{ udev_rules }}"
   notify: reload udev
diff --git a/roles/zerotier/tasks/main.yml b/roles/zerotier/tasks/main.yml
index b953d57..37617a1 100644
--- a/roles/zerotier/tasks/main.yml
+++ b/roles/zerotier/tasks/main.yml
@@ -13,7 +13,7 @@
       apt: name=zerotier-one
   when: ansible_pkg_mgr == "apt"
 - name: template unit file
-  template: src=zerotier-one.service dest=/etc/systemd/system/zerotier-one.service
+  template: src=zerotier-one.service dest=/etc/systemd/system/zerotier-one.service mode=0644
   notify: restart zerotier
 - name: join network
   command: