diff --git a/metal/roles/k3s/tasks/main.yml b/metal/roles/k3s/tasks/main.yml
index f1cb53c2..3e30ae10 100644
--- a/metal/roles/k3s/tasks/main.yml
+++ b/metal/roles/k3s/tasks/main.yml
@@ -68,4 +68,5 @@
   copy:
     content: "{{ kubeconfig_base64.content | b64decode | replace('127.0.0.1', hostvars[groups['masters'][0]].ansible_host) }}"
     dest: "{{ playbook_dir }}/kubeconfig.yaml"
+    mode: 0600
   delegate_to: localhost