diff --git a/lib/tiny-cloud/user-data/cloud-config b/lib/tiny-cloud/user-data/cloud-config
index 370987b..24904de 100644
--- a/lib/tiny-cloud/user-data/cloud-config
+++ b/lib/tiny-cloud/user-data/cloud-config
@@ -307,7 +307,7 @@ init__userdata_users() {
 		if in_list doas $keys; then
 			if [ -d "$ETC/doas.d" ]; then
 				touch "$ETC/doas.d/$name.conf"
-				chmod 660 "$ETC/doas.d/$name.conf"
+				chmod 640 "$ETC/doas.d/$name.conf"
 			fi
 			local j
 			for j in $(get_userdata users/$i/doas); do