diff --git a/PVE/API2/Subscription.pm b/PVE/API2/Subscription.pm
index 036824f2..77a42434 100644
--- a/PVE/API2/Subscription.pm
+++ b/PVE/API2/Subscription.pm
@@ -106,7 +106,7 @@ sub write_etc_subscription {
 	# add a generic one to handle the case where a new ceph release was made available while
 	# the subscription info was not yet updated, and as per APT_AUTH.CONF(5) start-with matches.
 	$ceph_auth .= "machine enterprise.proxmox.com/debian/ceph login $info->{key} password $info->{serverid}\n";
-	PVE::Tools::file_set_contents("/etc/apt/auth.conf.d/ceph.conf", $ceph_auth);
+	PVE::Tools::file_set_contents("/etc/apt/auth.conf.d/ceph.conf", $ceph_auth, 0600);
     }
 }