diff --git a/roles/nextcloud/tasks/main.yml b/roles/nextcloud/tasks/main.yml
index d582c48..2959401 100644
--- a/roles/nextcloud/tasks/main.yml
+++ b/roles/nextcloud/tasks/main.yml
@@ -72,7 +72,7 @@
           - name: Tighten config.php
             file:
               path: "{{ nextcloud_webroot }}/config/config.php"
-              mode: "0660"
+              mode: "0640"
           - name: Loosen occ
             file:
               path: "{{ nextcloud_webroot }}/occ"