diff --git a/site-modules/profile/manifests/swh/deploy/counters/journal_client.pp b/site-modules/profile/manifests/swh/deploy/counters/journal_client.pp
--- a/site-modules/profile/manifests/swh/deploy/counters/journal_client.pp
+++ b/site-modules/profile/manifests/swh/deploy/counters/journal_client.pp
@@ -16,7 +16,7 @@
     ensure  => present,
     owner   => 'root',
     group   => $group,
-    mode    => '0644',
+    mode    => '0640',
     content => inline_template("<%= @config.to_yaml %>\n"),
     notify  => Service[$service_name],
   }
diff --git a/site-modules/profile/manifests/swh/deploy/indexer_journal_client.pp b/site-modules/profile/manifests/swh/deploy/indexer_journal_client.pp
--- a/site-modules/profile/manifests/swh/deploy/indexer_journal_client.pp
+++ b/site-modules/profile/manifests/swh/deploy/indexer_journal_client.pp
@@ -18,7 +18,7 @@
     ensure  => present,
     owner   => 'root',
     group   => 'swhdev',
-    mode    => '0644',
+    mode    => '0640',
     content => inline_template("<%= @config.to_yaml %>\n"),
     notify  => Service[$service_name],
   }
diff --git a/site-modules/profile/manifests/swh/deploy/journal/backfill.pp b/site-modules/profile/manifests/swh/deploy/journal/backfill.pp
--- a/site-modules/profile/manifests/swh/deploy/journal/backfill.pp
+++ b/site-modules/profile/manifests/swh/deploy/journal/backfill.pp
@@ -16,7 +16,7 @@
     ensure  => present,
     owner   => $user,
     group   => $group,
-    mode    => '0644',
+    mode    => '0640',
     content => inline_template("<%= @config.to_yaml %>\n")
   }
 
diff --git a/site-modules/profile/manifests/swh/deploy/scheduler/journal_client.pp b/site-modules/profile/manifests/swh/deploy/scheduler/journal_client.pp
--- a/site-modules/profile/manifests/swh/deploy/scheduler/journal_client.pp
+++ b/site-modules/profile/manifests/swh/deploy/scheduler/journal_client.pp
@@ -16,7 +16,7 @@
     ensure  => present,
     owner   => 'root',
     group   => $group,
-    mode    => '0644',
+    mode    => '0640',
     content => inline_template("<%= @config.to_yaml %>\n"),
     notify  => Service[$service_name],
   }
diff --git a/site-modules/profile/manifests/swh/deploy/search/journal_client_instance.pp b/site-modules/profile/manifests/swh/deploy/search/journal_client_instance.pp
--- a/site-modules/profile/manifests/swh/deploy/search/journal_client_instance.pp
+++ b/site-modules/profile/manifests/swh/deploy/search/journal_client_instance.pp
@@ -21,7 +21,7 @@
         ensure  => 'present',
         owner   => $user,
         group   => $group,
-        mode    => '0644',
+        mode    => '0640',
         content => inline_template("<%= @config.to_yaml %>\n"),
         notify  => Service[$service_name],
       }
diff --git a/site-modules/profile/manifests/swh/deploy/worker/instance.pp b/site-modules/profile/manifests/swh/deploy/worker/instance.pp
--- a/site-modules/profile/manifests/swh/deploy/worker/instance.pp
+++ b/site-modules/profile/manifests/swh/deploy/worker/instance.pp
@@ -43,7 +43,7 @@
         ensure  => 'present',
         owner   => 'swhworker',
         group   => 'swhworker',
-        mode    => '0644',
+        mode    => '0640',
         content => inline_template("<%= @config.to_yaml %>\n"),
       }