diff --git a/hosts/modules/server/sops.nix b/hosts/modules/server/sops.nix
index df8ad14..fd01682 100644
--- a/hosts/modules/server/sops.nix
+++ b/hosts/modules/server/sops.nix
@@ -18,7 +18,10 @@
       #   owner = "nextcloud";
       #   group = "nextcloud";
       # };
-      cloudflare-apitoken = { path = "/etc/cloudflare/apiToken"; };
+      cloudflare-apitoken = {
+        mode = "0444"; # FIXME
+        path = "/etc/cloudflare/apiToken";
+      };
       # tailscaled-authKey = {
       #   path = "/etc/tailscale/authKey";
       #   owner = "tailscaled";