diff --git a/ansible/roles/cluster/tasks/initialize.yml b/ansible/roles/cluster/tasks/initialize.yml
index c49ff273..d83c71d0 100644
--- a/ansible/roles/cluster/tasks/initialize.yml
+++ b/ansible/roles/cluster/tasks/initialize.yml
@@ -24,6 +24,7 @@
   template:
     src: kubeadm-init.yml.j2
     dest: /etc/kubernetes/kubeadm-init.yml
+    mode: 0644
 
 - name: initialize cluster (with kube-proxy)
   command:
diff --git a/ansible/roles/cluster/tasks/join.yml b/ansible/roles/cluster/tasks/join.yml
index 5af0fe93..cb924109 100644
--- a/ansible/roles/cluster/tasks/join.yml
+++ b/ansible/roles/cluster/tasks/join.yml
@@ -13,3 +13,4 @@
   command:
     cmd: kubeadm join --config /etc/kubernetes/kubeadm-join.yml
     creates: /etc/kubernetes/kubelet.conf
+    mode: 0644
diff --git a/ansible/roles/common/tasks/common.yml b/ansible/roles/common/tasks/common.yml
index 4f2d5517..18a81875 100644
--- a/ansible/roles/common/tasks/common.yml
+++ b/ansible/roles/common/tasks/common.yml
@@ -31,6 +31,7 @@
       NTP={{ common_ntp_servers | join(' ') }}
       FallbackNTP={{ common_fallback_ntp_servers | join(' ') }}
     dest: /etc/systemd/timesyncd.conf
+    mode: 0644
 
 - name: set timezone
   command: "/usr/bin/timedatectl set-timezone {{ common_timezone }}"
diff --git a/ansible/roles/kubernetes/tasks/debian.yml b/ansible/roles/kubernetes/tasks/debian.yml
index d7a8bbb1..d758713f 100644
--- a/ansible/roles/kubernetes/tasks/debian.yml
+++ b/ansible/roles/kubernetes/tasks/debian.yml
@@ -82,6 +82,7 @@
   file:
     path: /boot/firmware/nobtcmd.txt
     state: touch
+    mode: 0644
   when: ansible_architecture | regex_search('arm|aarch')
 
 - name: enable required cgroup features