diff --git a/util/secret/certificates.go b/util/secret/certificates.go
index 8af1c12eecf3..ac1f76399d8f 100644
--- a/util/secret/certificates.go
+++ b/util/secret/certificates.go
@@ -393,7 +393,7 @@ func (c *Certificate) AsFiles() []bootstrapv1.File {
 		out = append(out, bootstrapv1.File{
 			Path:        c.CertFile,
 			Owner:       rootOwnerValue,
-			Permissions: "0640",
+			Permissions: "0600",
 			Content:     string(c.KeyPair.Cert),
 		})
 	}