diff --git a/roles/webserver/tasks/main.yaml b/roles/webserver/tasks/main.yaml
index 78fdfd1..a9f20fe 100644
--- a/roles/webserver/tasks/main.yaml
+++ b/roles/webserver/tasks/main.yaml
@@ -37,6 +37,9 @@
   ansible.builtin.template:
     src: cf-creds.ini
     dest: /root/cf-creds.ini
+    owner: root
+    group: root
+    mode: 0600
 
 - name: Generate certificate for all server instances
   ansible.builtin.command: