diff --git a/tasks/repos.yml b/tasks/repos.yml
index 62b929b..37da939 100644
--- a/tasks/repos.yml
+++ b/tasks/repos.yml
@@ -10,6 +10,9 @@
 - name: repos | Enable Proxmox no-subscription repo
   ansible.builtin.copy:
     dest: /etc/apt/sources.list.d/pve-no-subscription.list
+    owner: root
+    group: root
+    mode: "0644"
     content: |
       deb http://download.proxmox.com/debian/pve {{ ansible_distribution_release }} pve-no-subscription
   notify: apt update