diff --git a/hosts/AZ-PRM-1/secrets.nix b/hosts/AZ-PRM-1/secrets.nix
index 4966208..833f6d7 100644
--- a/hosts/AZ-PRM-1/secrets.nix
+++ b/hosts/AZ-PRM-1/secrets.nix
@@ -7,6 +7,9 @@ in {
       {
         atrocore-env = {
           file = ../../secrets/atrocore-env.age;
+          owner = "postgres";
+          group = "postgres";
+          mode = "0400";
         };
         atrocore-registry-token = {
           file = ../../secrets/atrocore-registry-token.age;