diff --git a/systems/palatine-hill/garage.nix b/systems/palatine-hill/garage.nix
index beac54e..4e9514f 100644
--- a/systems/palatine-hill/garage.nix
+++ b/systems/palatine-hill/garage.nix
@@ -67,7 +67,17 @@ in
   };
 
   sops.secrets = {
-    "garage/rpc-secret" = { };
-    "garage/admin-token" = { };
+    "garage/rpc-secret" = {
+      owner = "garage";
+      group = "garage";
+      mode = "0400";
+      restartUnits = [ "garage.service" ];
+    };
+    "garage/admin-token" = {
+      owner = "garage";
+      group = "garage";
+      mode = "0400";
+      restartUnits = [ "garage.service" ];
+    };
   };
 }