diff --git a/jobs/services/api.hcl b/jobs/services/api.hcl
index 1015b48..4cdaf37 100644
--- a/jobs/services/api.hcl
+++ b/jobs/services/api.hcl
@@ -70,6 +70,7 @@ EOH
 
     template {
         destination = "local/ldap.secret"
+        perms       = "600"
         data = "{{ key \"api/ldap/secret\" }}" # this is necessary as the secret has no EOF
       }
 
diff --git a/jobs/services/brickbot.hcl b/jobs/services/brickbot.hcl
index 1fcb3b8..872a84d 100644
--- a/jobs/services/brickbot.hcl
+++ b/jobs/services/brickbot.hcl
@@ -22,6 +22,7 @@ job "brickbot2" {
 
       template {
         destination = "local/ldap.secret"
+        perms       = "600"
         data = "{{ key \"api/ldap/secret\" }}" # this is necessary as the secret has no EOF
       }