diff --git a/roles/add-launchpad-credentials/tasks/main.yaml b/roles/add-launchpad-credentials/tasks/main.yaml
index 63ca0b89e..f0eeb3bf8 100644
--- a/roles/add-launchpad-credentials/tasks/main.yaml
+++ b/roles/add-launchpad-credentials/tasks/main.yaml
@@ -2,6 +2,7 @@
   file:
     path: ~/.launchpadlib
     state: directory
+    mode: 0700
 
 - name: Write credentials
   template:
diff --git a/roles/ara-report/tasks/main.yaml b/roles/ara-report/tasks/main.yaml
index 5eb2bf4d5..d95e5cc42 100644
--- a/roles/ara-report/tasks/main.yaml
+++ b/roles/ara-report/tasks/main.yaml
@@ -81,6 +81,7 @@
       file:
         path: "{{ ara_report_path }}"
         state: directory
+        mode: 0755
 
     - name: Save the ARA database
       command: cp {{ ara_database_path }} {{ ara_report_path }}
diff --git a/roles/configure-mirrors/tasks/mirror/CentOS-8-stream.yaml b/roles/configure-mirrors/tasks/mirror/CentOS-8-stream.yaml
index b407fbe47..afec7bb57 100644
--- a/roles/configure-mirrors/tasks/mirror/CentOS-8-stream.yaml
+++ b/roles/configure-mirrors/tasks/mirror/CentOS-8-stream.yaml
@@ -27,4 +27,5 @@
     path: /etc/dnf.conf
     section: main
     option: deltarpm
-    value: 0
+    value: "0"
+    mode: 0644
diff --git a/roles/enable-netconsole/tasks/main.yaml b/roles/enable-netconsole/tasks/main.yaml
index e46e064f6..2478546da 100644
--- a/roles/enable-netconsole/tasks/main.yaml
+++ b/roles/enable-netconsole/tasks/main.yaml
@@ -59,6 +59,7 @@
       file:
         path: '{{ nc_target }}'
         state: directory
+        mode: 0755
 
     - name: Configure gateway
       shell: 'echo {{ default_gw_dev }} > {{ nc_target }}/dev_name'
diff --git a/roles/ensure-chart-testing/tasks/main.yaml b/roles/ensure-chart-testing/tasks/main.yaml
index fca772e7a..d6a24d949 100644
--- a/roles/ensure-chart-testing/tasks/main.yaml
+++ b/roles/ensure-chart-testing/tasks/main.yaml
@@ -22,6 +22,7 @@
   file:
     path: /etc/ct
     state: directory
+    mode: 0755
 
 - name: Install configuration files
   become: true
diff --git a/roles/multi-node-bridge/tasks/common.yaml b/roles/multi-node-bridge/tasks/common.yaml
index 9ca363f7b..a1b56baed 100644
--- a/roles/multi-node-bridge/tasks/common.yaml
+++ b/roles/multi-node-bridge/tasks/common.yaml
@@ -19,11 +19,13 @@
       copy:
         src: RPM-GPG-KEY-CentOS-SIG-Cloud
         dest: /tmp/RPM-GPG-KEY-CentOS-SIG-Cloud
+        mode: 0644
 
     - name: Set up RDO repository
       template:
         src: zuul-multi-node-bridge-ovs.repo.j2
         dest: /etc/yum.repos.d/zuul-multi-node-bridge-ovs.repo
+        mode: 0644
 
 - name: Set package.use values for OVS on Gentoo
   become: yes
@@ -31,6 +33,7 @@
     path: /etc/portage/package.use/ovs
     line: "{{ zj_item.line }}"
     create: yes
+    mode: 0644
   loop:
     - { line: 'dev-python/twisted conch  # for openvswitch' }
     - { line: 'sys-apps/util-linux caps  # for openvswitch' }
diff --git a/roles/terraform/tasks/main.yaml b/roles/terraform/tasks/main.yaml
index 2bc054d40..487226964 100644
--- a/roles/terraform/tasks/main.yaml
+++ b/roles/terraform/tasks/main.yaml
@@ -8,6 +8,7 @@
   copy:
     content: "{{ zj_override.content }}"
     dest: "{{ zj_override.dir }}/override.tf"
+    mode: 0644
   loop: "{{ terraform_overrides }}"
   loop_control:
     loop_var: zj_override