diff --git a/manifests/key.pp b/manifests/key.pp
index a354eb4..4d73cfd 100644
--- a/manifests/key.pp
+++ b/manifests/key.pp
@@ -35,7 +35,7 @@ define bind::key (
         ensure  => present,
         owner   => $owner,
         group   => $group,
-        mode    => '0640',
+        mode    => '0400',
         replace => $replace,
         content => template('bind/key.conf.erb'),
     }
diff --git a/manifests/keydir.pp b/manifests/keydir.pp
index 6bf8952..ecd31df 100644
--- a/manifests/keydir.pp
+++ b/manifests/keydir.pp
@@ -6,5 +6,7 @@ class bind::keydir (
     file { $keydir:
         ensure => directory,
         mode   => '0755',
+        owner  => 'root',
+        group  => 'bind',
     }
 }