diff --git a/roles/api/tasks/main.yml b/roles/api/tasks/main.yml
index 26ade3dd16052cdf59256675df027b95b736ab1f..10e087446f3e1bcf3b8d8f886b84f2b4deb86587 100644
--- a/roles/api/tasks/main.yml
+++ b/roles/api/tasks/main.yml
@@ -10,7 +10,9 @@
     template:
       src: templates/mail-receiver-environment.json.j2
       dest: /etc/exim4/mail-receiver-environment.json
-      mode: 0644
+      mode: 0640
+      group: Debian-exim
+      owner: root
 
   when: mail_receiver_environment.stat.exists == False