diff --git a/site-modules/profile/manifests/hedgedoc.pp b/site-modules/profile/manifests/hedgedoc.pp
--- a/site-modules/profile/manifests/hedgedoc.pp
+++ b/site-modules/profile/manifests/hedgedoc.pp
@@ -95,7 +95,8 @@
     ensure  => present,
     owner   => $user,
     group   => $group,
-    mode    => '0644',
+    # Contains credentials
+    mode    => '0600',
     content => template("profile/hedgedoc/config.json.erb"),
   } ~>
   file {$sequelizerc_config_sequelizerc_path: