diff --git a/manifests/config.pp b/manifests/config.pp
index f6a9e67..964ce8a 100644
--- a/manifests/config.pp
+++ b/manifests/config.pp
@@ -28,9 +28,9 @@
   file { '/etc/tomcat/server.xml':
     ensure  => file,
     content => template('candlepin/tomcat/server.xml.erb'),
-    mode    => '0644',
+    mode    => '0640',
     owner   => 'root',
-    group   => 'root',
+    group   => $candlepin::group,
   }
 
   file { '/etc/tomcat/tomcat.conf':