diff --git a/hosts/hitsugibune/vaultwarden.nix b/hosts/hitsugibune/vaultwarden.nix
index 37b03b7..a0e0377 100644
--- a/hosts/hitsugibune/vaultwarden.nix
+++ b/hosts/hitsugibune/vaultwarden.nix
@@ -6,6 +6,9 @@ in
 {
   age.secrets.vaultwarden-env = {
     file = ../../secrets/vaultwarden.age;
+    owner = "vaultwarden";
+    group = "vaultwarden";
+    mode = "0400";
   };
 
   networking.firewall.allowedTCPPorts = [ 80 443 ];