diff --git a/roles/restore_metadata/tasks/main.yml b/roles/restore_metadata/tasks/main.yml
index 5c13946..8afd08b 100644
--- a/roles/restore_metadata/tasks/main.yml
+++ b/roles/restore_metadata/tasks/main.yml
@@ -17,6 +17,7 @@
         bucket: "{{ atl_backup_manifest_bucket }}"
         object: "{{ atl_backup_manifest_path }}"
         dest: "{{ atl_backup_manifest_dest }}"
+        mode: 0600
       when: atl_backup_manifest_url.scheme == 's3'
 
     - name: Fetch the manifest from remote host