diff --git a/manifests/swh/deploy/worker/base.pp b/manifests/swh/deploy/worker/base.pp
index ea8ee4f..17d4b95 100644
--- a/manifests/swh/deploy/worker/base.pp
+++ b/manifests/swh/deploy/worker/base.pp
@@ -1,62 +1,62 @@
 # Base worker profile
 class profile::swh::deploy::worker::base {
   include ::systemd
 
   $systemd_template_unit_name = 'swh-worker@.service'
   $systemd_template_unit_file = "/etc/systemd/system/${systemd_template_unit_name}"
   $systemd_unit_name = 'swh-worker.service'
   $systemd_unit_file = "/etc/systemd/system/${systemd_unit_name}"
   $systemd_generator = '/lib/systemd/system-generators/swh-worker-generator'
   $config_directory = '/etc/softwareheritage/worker'
 
   package {'python3-swh.scheduler':
     ensure => installed,
   }
 
   file {$systemd_template_unit_file:
     ensure => 'present',
     owner  => 'root',
     group  => 'root',
     mode   => '0644',
     source => "puppet:///modules/profile/swh/deploy/worker/${systemd_template_unit_name}",
     notify => Exec['systemd-daemon-reload'],
   }
 
   file {$systemd_unit_file:
     ensure => 'present',
     owner  => 'root',
     group  => 'root',
     mode   => '0644',
     source => "puppet:///modules/profile/swh/deploy/worker/${systemd_unit_name}",
     notify => Exec['systemd-daemon-reload'],
   }
 
   file {$systemd_generator:
     ensure => 'present',
     owner  => 'root',
     group  => 'root',
     mode   => '0755',
     source => 'puppet:///modules/profile/swh/deploy/worker/swh-worker-generator',
     notify => Exec['systemd-daemon-reload'],
   }
 
   file {$config_directory:
     ensure  => 'directory',
     owner   => 'swhworker',
-    group   => 'swhworker',
+    group   => 'swhdev',
     mode    => '0644',
     purge   => true,
     recurse => true,
   }
 
   service {'swh-worker':
     ensure  => running,
     enable  => true,
     require => [
       Exec['systemd-daemon-reload'],
       File[$systemd_template_unit_file],
       File[$systemd_unit_file],
       File[$systemd_generator],
     ],
   }
 }
diff --git a/manifests/swh/deploy/worker/instance.pp b/manifests/swh/deploy/worker/instance.pp
index 573a57c..469b51b 100644
--- a/manifests/swh/deploy/worker/instance.pp
+++ b/manifests/swh/deploy/worker/instance.pp
@@ -1,83 +1,84 @@
 # Instance of a worker
 define profile::swh::deploy::worker::instance (
   $ensure = present,
   $task_broker = '',
   $task_modules = [],
   $task_queues = [],
   $task_soft_time_limit = '',
   $concurrency = 10,
   $loglevel = 'info',
   $max_tasks_per_child = 5,
   $instance_name = $title)
 {
   include ::profile::swh::deploy::worker::base
   include ::systemd
 
   $service_basename = "swh-worker@${instance_name}"
   $service_name = "${service_basename}.service"
   $systemd_dir = "/etc/systemd/system/${service_name}.d"
   $systemd_snippet = "${systemd_dir}/parameters.conf"
   $config_directory = '/etc/softwareheritage/worker'
   $instance_config = "${config_directory}/${instance_name}.ini"
 
   case $ensure {
     'present': {
       file {$systemd_dir:
         ensure => directory,
         owner  => 'root',
         group  => 'root',
         mode   => '0755',
       }
 
       # Uses variables
       # - $concurrency
       # - $loglevel
       # - $max_tasks_per_child
       file {$systemd_snippet:
         ensure  => present,
         owner   => 'root',
         group   => 'root',
         mode    => '0644',
         content => template('profile/swh/deploy/worker/parameters.conf.erb'),
         notify => [
           Exec['systemd-daemon-reload'],
           Service[$service_basename],
         ]
       }
 
       # Uses variables
       # - $task_broker
       # - $task_modules
       # - $task_queues
       # - $task_soft_time_limit
       file {$instance_config:
         ensure  => present,
         owner   => 'swhworker',
-        group   => 'swhworker',
+        group   => 'swhdev',
+        # contains a password for the broker
         mode    => '0640',
         content => template('profile/swh/deploy/worker/instance_config.ini.erb'),
       }
 
       service {$service_basename:
         ensure => running,
         require => [
           File[$instance_config],
           File[$systemd_snippet],
         ],
       }
 
     }
     default: {
       file {[
         $systemd_dir,
         $instance_config,
       ]:
         ensure => absent,
       }
 
       service {$service_basename:
         ensure => stopped,
       }
     }
   }
 }