diff --git a/kube/deployment.yaml b/kube/deployment.yaml
index 8ff1f6a..e1bc867 100644
--- a/kube/deployment.yaml
+++ b/kube/deployment.yaml
@@ -59,6 +59,7 @@ spec:
       - name: openvpn-pki
         secret:
           secretName: openvpn-pki
+          defaultMode: 0400
       - name: openvpn-ccd
         configMap:
           name: openvpn-ccd