diff --git a/REFERENCE.md b/REFERENCE.md
index 2cac8af..dd7b789 100644
--- a/REFERENCE.md
+++ b/REFERENCE.md
@@ -75,7 +75,7 @@ Data type: `String`
 
 mode of $configfile
 
-Default value: `'0555'`
+Default value: `'0600'`
 
 ## Defined types
 
diff --git a/manifests/init.pp b/manifests/init.pp
index 0622420..8d7a1e8 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -25,7 +25,7 @@
   Hash   $entries    = {},
   String $owner      = 'root',
   String $group      = 'wheel',
-  String $mode       = '0555',
+  String $mode       = '0600',
 ) {
   concat { $configfile:
     owner        => $owner,
diff --git a/spec/classes/doas_spec.rb b/spec/classes/doas_spec.rb
index 505a1c6..58cd143 100644
--- a/spec/classes/doas_spec.rb
+++ b/spec/classes/doas_spec.rb
@@ -11,7 +11,7 @@
         is_expected.to contain_concat('/etc/doas.conf')
           .with_owner('root')
           .with_group('wheel')
-          .with_mode('0555')
+          .with_mode('0600')
       }
       it {
         is_expected.to contain_concat__fragment('doas header')