diff --git a/handlers/main.yml b/handlers/main.yml
index 422b45d3..011f35de 100644
--- a/handlers/main.yml
+++ b/handlers/main.yml
@@ -119,6 +119,9 @@
   copy:
     src: "/etc/keystone/policy.json-{{ keystone_venv_tag }}"
     dest: "/etc/keystone/policy.json"
+    owner: "root"
+    group: "{{ keystone_system_group_name }}"
+    mode: "0640"
     remote_src: yes
   tags:
     - keystone-config