diff --git a/roles/www_options/tasks/main.yml b/roles/www_options/tasks/main.yml
index b33b5c92b..70df9f95c 100644
--- a/roles/www_options/tasks/main.yml
+++ b/roles/www_options/tasks/main.yml
@@ -86,7 +86,7 @@
   template:
     src: 020_apache_poweroff.j2
     dest: /etc/sudoers.d/020_apache_poweroff
-    mode: '0755'
+    mode: '0440'
   when: apache_allow_sudo | bool
 
 - name: Remove {{ apache_user }} (per variable apache_user) permission to poweroff, removing /etc/sudoers.d/020_apache_poweroff