diff --git a/handlers/main.yml b/handlers/main.yml
index cee6f6d..e7c53fc 100644
--- a/handlers/main.yml
+++ b/handlers/main.yml
@@ -49,6 +49,9 @@
   copy:
     src: "/etc/gnocchi/policy.json-{{ gnocchi_venv_tag }}"
     dest: "/etc/gnocchi/policy.json"
+    owner: "root"
+    group: "{{ gnocchi_system_group_name }}"
+    mode: "0640"
     remote_src: yes
 
 - name: Start services