diff --git a/age-secrets.nix b/age-secrets.nix
index db2b772..709c59f 100644
--- a/age-secrets.nix
+++ b/age-secrets.nix
@@ -39,9 +39,10 @@
       group = "caddy";
     };
 
+    # TODO! fix permissions
     jellyfin-api-key = {
       file = ./secrets/jellyfin-api-key.age;
-      mode = "0400";
+      mode = "0444";
       owner = "root";
       group = "root";
     };