diff --git a/hosts/sid/services/step-ca.nix b/hosts/sid/services/step-ca.nix
index 20fcae3..9ec74de 100644
--- a/hosts/sid/services/step-ca.nix
+++ b/hosts/sid/services/step-ca.nix
@@ -75,6 +75,8 @@ in
     certs."sid-internal" = {
       domain = "*.${constants.intranet}";
       server = "https://${constants.ca-fqdn}:${toString cfg.port}/acme/acme/directory";
+      group = "nginx";
+      mode = "0640";
     };
   };