diff --git a/swh-graphql/templates/deployment.yaml b/swh-graphql/templates/deployment.yaml
index 8a8ee6a..5ccae45 100644
--- a/swh-graphql/templates/deployment.yaml
+++ b/swh-graphql/templates/deployment.yaml
@@ -1,53 +1,53 @@
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: graphql
   namespace: {{ .Values.namespace }}
   labels:
     app: graphql
 spec:
   replicas: {{ .Values.replicas }}
   selector:
     matchLabels:
       app: graphql
   strategy:
     type: RollingUpdate
     rollingUpdate:
       maxSurge: 1
   template:
     metadata:
       labels:
         app: graphql
       annotations:
         # Force a rollout upgrade if the configuration changes
         checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
     spec:
       containers:
         - name: graphql
           image: {{ .Values.image.name }}:{{ .Values.image.version }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           ports:
             - containerPort: 5013
           env:
           - name: PORT
             value: "5013"
           - name: THREADS
             value: {{ .Values.gunicornThreads | quote }}
           - name: WORKERS
             value: {{ .Values.gunicornWorkers | quote }}
           - name: LOG_LEVEL
             value: {{ .Values.logLevel | quote }}
           - name: TIMEOUT
             value: {{ .Values.gunicornTimeout | quote }}
           volumeMounts:
             - name: config
               mountPath: /etc/swh/config.yml
               subPath: config.yml
               readOnly: true
       volumes:
         - name: config
           configMap:
             name: graphql
-            defaultMode: 0400
+            defaultMode: 0444