diff --git a/software/cloudooo/software.cfg b/software/cloudooo/software.cfg
index c1d83372ecc4f7d4c8a309c7830b9971124ca500..a338cbb183794a01c5cfcb8c051af8599020197a 100644
--- a/software/cloudooo/software.cfg
+++ b/software/cloudooo/software.cfg
@@ -21,6 +21,7 @@ cert = ${slap-connection:cert-file}
 
 [template-jinja2-base]
 recipe = slapos.recipe.template:jinja2
+mode = 640
 template = ${:_profile_base_location_}/${:filename}.in
 rendered = ${buildout:directory}/${:filename}
 # XXX: extra-context is needed because we cannot append to a key of an extended
diff --git a/software/varnish/software.cfg b/software/varnish/software.cfg
index f76247fd1ca14bcb091476936ad454272cbc0c24..722fbde9c6878f1286742e06aa2173850aa65073 100644
--- a/software/varnish/software.cfg
+++ b/software/varnish/software.cfg
@@ -45,6 +45,7 @@ command = grep parts ${buildout:develop-eggs-directory}/slapos.cookbook.egg-link
 
 [template-jinja2-base]
 recipe = slapos.recipe.template:jinja2
+mode = 640
 template = ${:_profile_base_location_}/${:filename}.in
 rendered = ${buildout:directory}/${:filename}
 # XXX: extra-context is needed because we cannot append to a key of an extended
diff --git a/stack/erp5/buildout.cfg b/stack/erp5/buildout.cfg
index 01c5b7d7c99b03daff3099b638284e5611978e0e..40e5420522078edea6b5f90731eb0cc85bd10e9f 100644
--- a/stack/erp5/buildout.cfg
+++ b/stack/erp5/buildout.cfg
@@ -133,6 +133,7 @@ parts =
 
 [template-jinja2-base]
 recipe = slapos.recipe.template:jinja2
+mode = 640
 template = ${:_profile_base_location_}/${:filename}.in
 rendered = ${buildout:directory}/${:filename}
 # XXX: extra-context is needed because we cannot append to a key of an extended