diff --git a/modules/adguard.nix b/modules/adguard.nix
index d3e52cc..cab559f 100644
--- a/modules/adguard.nix
+++ b/modules/adguard.nix
@@ -69,6 +69,9 @@ in
   config = lib.mkIf cfg.enable {
     # Provide an adguard clients partial config for injection
     sops.templates."adguard_clients.yaml" = {
+      owner = "root";
+      group = "adguardhome";
+      mode = "0440";
       content = builtins.toJSON {
         clients = {
           persistent = map (client: {