diff --git a/global/overlay/etc/puppet/modules/soc/manifests/naemon_monitor.pp b/global/overlay/etc/puppet/modules/soc/manifests/naemon_monitor.pp
index dc97783..1e9a2d6 100644
--- a/global/overlay/etc/puppet/modules/soc/manifests/naemon_monitor.pp
+++ b/global/overlay/etc/puppet/modules/soc/manifests/naemon_monitor.pp
@@ -96,7 +96,7 @@ class soc::naemon_monitor (
   }
 
   if lookup('shib_key', undef, undef, undef) != undef {
-    sunet::snippets::secret_file { '/opt/naemon_monitor/shib-certs/sp-key.pem': hiera_key => 'shib_key' }
+    sunet::snippets::secret_file { '/opt/naemon_monitor/shib-certs/sp-key.pem': hiera_key => 'shib_key', mode => '0444' }
     # assume cert is in cosmos repo (overlay)
   }
   if $custom_shib {