diff --git a/templates/web.template.yml b/templates/web.template.yml
index 5e5229af8..37dfc38d3 100644
--- a/templates/web.template.yml
+++ b/templates/web.template.yml
@@ -45,7 +45,7 @@ run:
         conf=/var/www/discourse/config/discourse.conf
 
         # find DISCOURSE_ env vars, strip the leader, lowercase the key
-        /usr/local/bin/ruby -e 'ENV.each{|k,v| puts "#{$1.downcase} = '\''#{v}'\''" if k =~ /^DISCOURSE_(.*)/}' > $conf
+        /usr/local/bin/ruby -e 'ENV.each{|k,v| puts "#{$1.downcase} = '\''#{v}'\''" if k =~ /^DISCOURSE_(.*)/}' | install -m 600 -o discourse /dev/stdin ${conf}
 
   - file:
      path: /etc/service/unicorn/run