diff --git a/systems/zaatar/configuration.nix b/systems/zaatar/configuration.nix
index 1a172af..38ec856 100644
--- a/systems/zaatar/configuration.nix
+++ b/systems/zaatar/configuration.nix
@@ -45,7 +45,12 @@ in {
       owner = "tinc.retiolum";
       group = "tinc.retiolum";
     };
-    restic.file = ../../secrets/restic.age;
+    restic = {
+      file = ../../secrets/restic.age;
+      mode = "400";
+      owner = "restic";
+      group = "restic";
+    };
   };
 
   services.restic.backups.niveum = {