diff --git a/services/buildbot/default.nix b/services/buildbot/default.nix
index f771d60..4cd482e 100644
--- a/services/buildbot/default.nix
+++ b/services/buildbot/default.nix
@@ -31,7 +31,11 @@ in
     age.secrets.buildbot-oauth-secret.file = ../../secrets/buildbot-oauth-secret.age;
     age.secrets.buildbot-workers.file = ../../secrets/buildbot-workers.age;
     age.secrets.buildbot-service-key.file = ../../secrets/buildbot-service-key.age;
-    age.secrets.buildbot-signing-key.file = ../../secrets/buildbot-signing-key.age;
+    age.secrets.buildbot-signing-key = {
+      file = ../../secrets/buildbot-signing-key.age;
+      owner = "buildbot-worker";
+      group = "buildbot-worker";
+    };
     age.secrets.buildbot-remote-builder-key = {
       file = ../../secrets/buildbot-remote-builder-key.age;
       owner = "buildbot-worker";