diff --git a/systems/palatine-hill/configuration.nix b/systems/palatine-hill/configuration.nix
index b0c33dd..dd4d241 100644
--- a/systems/palatine-hill/configuration.nix
+++ b/systems/palatine-hill/configuration.nix
@@ -256,7 +256,8 @@ in
         "alice/gha-hydra-token" = {
           sopsFile = ../../users/alice/secrets.yaml;
           owner = "hydra";
-          mode = "400";
+          group = "hydra";
+          mode = "440";
         };
       }
       // keygen "zfs-attic-key"