diff --git a/playbooks/include/deploy-kvm-guest.yml b/playbooks/include/deploy-kvm-guest.yml
index fc6209b..2ab1e90 100644
--- a/playbooks/include/deploy-kvm-guest.yml
+++ b/playbooks/include/deploy-kvm-guest.yml
@@ -74,6 +74,9 @@
           echo '{{ root_pubkey }}' > /root/.ssh/authorized_keys
           %end
         dest: "{{ tmpdir.path }}/include.ks"
+        mode: 0600
+        owner: root
+        group: "{{ ansible_wheel }}"
       delegate_to: "{{ vmhost }}"
       when:
         - inventory_hostname not in result.list_vms