diff --git a/CHANGELOG.md b/CHANGELOG.md
index 49659ec..f68d77d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,8 @@
 openstack-block-storage Cookbook CHANGELOG
 ==============================
 This file is used to list changes made in each version of the openstack-block-storage cookbook.
+## 10.0.1
+# Update cinder.conf mode from 0644 to 0640
 
 ## 10.0.0
 * Upgrading to Juno
diff --git a/metadata.rb b/metadata.rb
index 1e7b6bb..a035a8e 100644
--- a/metadata.rb
+++ b/metadata.rb
@@ -5,7 +5,7 @@ maintainer_email 'cookbooks@lists.tfoundry.com'
 license          'Apache 2.0'
 description      'The OpenStack Advanced Volume Management service Cinder.'
 long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
-version          '10.0.0'
+version          '10.0.1'
 
 recipe           'openstack-block-storage::api', 'Installs the cinder-api, sets up the cinder database, and cinder service/user/endpoints in keystone'
 recipe           'openstack-block-storage::client', 'Install packages required for cinder client'
diff --git a/recipes/cinder-common.rb b/recipes/cinder-common.rb
index 8074164..7a51669 100644
--- a/recipes/cinder-common.rb
+++ b/recipes/cinder-common.rb
@@ -90,7 +90,7 @@ template '/etc/cinder/cinder.conf' do
   source 'cinder.conf.erb'
   group node['openstack']['block-storage']['group']
   owner node['openstack']['block-storage']['user']
-  mode 00644
+  mode 00640
   variables(
     sql_connection: sql_connection,
     mq_service_type: mq_service_type,
diff --git a/spec/cinder_common_spec.rb b/spec/cinder_common_spec.rb
index c8e6e94..09124a7 100644
--- a/spec/cinder_common_spec.rb
+++ b/spec/cinder_common_spec.rb
@@ -72,7 +72,7 @@ describe 'openstack-block-storage::cinder-common' do
       end
 
       it 'has proper modes' do
-        expect(sprintf('%o', file.mode)).to eq '644'
+        expect(sprintf('%o', file.mode)).to eq '640'
       end
 
       context 'template keystone contents' do
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index 8f3c301..ab32a8a 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -108,7 +108,7 @@ def expect_creates_cinder_conf(service, user, group, action = :restart) # ruboco
     end
 
     it 'has proper modes' do
-      expect(sprintf('%o', file.mode)).to eq '644'
+      expect(sprintf('%o', file.mode)).to eq '640'
     end
 
     it 'notifies service restart' do