diff --git a/hosts/nas/sops.nix b/hosts/nas/sops.nix
index b720548..7d82efd 100755
--- a/hosts/nas/sops.nix
+++ b/hosts/nas/sops.nix
@@ -116,39 +116,39 @@ in
       "jallen-nas/free-games/gog-pass" = { };
       "ssh-keys-public/jallen-nas-root" = {
         path = "/root/.ssh/id_ed25519.pub";
-        mode = "0600";
+        mode = "0640";
       };
       "ssh-keys-private/jallen-nas-root" = {
         path = "/root/.ssh/id_ed25519";
-        mode = "0600";
+        mode = "0640";
       };
       "secureboot/GUID" = {
         path = "/etc/secureboot/GUID";
-        mode = "0600";
+        mode = "0640";
       };
       "secureboot/keys/db-key" = {
         path = "/etc/secureboot/keys/db/db.key";
-        mode = "0600";
+        mode = "0640";
       };
       "secureboot/keys/db-pem" = {
         path = "/etc/secureboot/keys/db/db.pem";
-        mode = "0600";
+        mode = "0640";
       };
       "secureboot/keys/KEK-key" = {
         path = "/etc/secureboot/keys/KEK/KEK.key";
-        mode = "0600";
+        mode = "0640";
       };
       "secureboot/keys/KEK-pem" = {
         path = "/etc/secureboot/keys/KEK/KEK.pem";
-        mode = "0600";
+        mode = "0640";
       };
       "secureboot/keys/PK-key" = {
         path = "/etc/secureboot/keys/PK/PK.key";
-        mode = "0600";
+        mode = "0640";
       };
       "secureboot/keys/PK-pem" = {
         path = "/etc/secureboot/keys/PK/PK.pem";
-        mode = "0600";
+        mode = "0640";
       };
     };