diff --git a/lxc-apps/ckan/install.sh b/lxc-apps/ckan/install.sh
index 6bf30e0..2b28400 100755
--- a/lxc-apps/ckan/install.sh
+++ b/lxc-apps/ckan/install.sh
@@ -16,8 +16,8 @@ install -o 105432 -g 105432 -m 700 -d ${POSTGRES_DATA}
 spoc-container exec ckan-postgres -- initdb -D /var/lib/postgresql
 
 # Configure Postgres
-install postgres_data/postgresql.conf ${POSTGRES_DATA}/postgresql.conf
-install postgres_data/pg_hba.conf ${POSTGRES_DATA}/pg_hba.conf
+install -o 105432 -g 105432 -m 600 postgres_data/postgresql.conf ${POSTGRES_DATA}/postgresql.conf
+install -o 105432 -g 105432 -m 600 postgres_data/pg_hba.conf ${POSTGRES_DATA}/pg_hba.conf
 
 # Create database
 export CKAN_PWD=$(head -c 18 /dev/urandom | base64 | tr -d '+/=')
@@ -26,36 +26,36 @@ spoc-container start ckan-postgres
 envsubst <createdb.sql | spoc-container exec ckan-postgres -- psql
 
 # Configure Redis
-install -o 100000 -g 100000 -d ${REDIS_CONF}
-install -o 106379 -g 106379 -d ${REDIS_DATA}
-install -o 106379 -g 106379 redis_conf/redis.conf ${REDIS_CONF}/redis.conf
+install -o 100000 -g 106379 -m 750 -d ${REDIS_CONF}
+install -o 106379 -g 106379 -m 750 -d ${REDIS_DATA}
+install -o 100000 -g 106379 -m 640 redis_conf/redis.conf ${REDIS_CONF}/redis.conf
 spoc-container start ckan-redis
 
 # Configure Solr
-install -o 108983 -g 108983 -d ${SOLR_DATA}
-install -o 108983 -g 108983 ${LAYERS_DIR}/solr6_6.5.1-200313/opt/solr/server/solr/solr.xml ${SOLR_DATA}/solr.xml
+install -o 108983 -g 108983 -m 750 -d ${SOLR_DATA}
+install -o 108983 -g 108983 -m 640 ${LAYERS_DIR}/solr6_6.5.1-200313/opt/solr/server/solr/solr.xml ${SOLR_DATA}/solr.xml
 spoc-container start ckan-solr
 
 # Configure CKAN Solr core
 spoc-container exec ckan-solr -- solr create -p 8983 -c ckan
 spoc-container stop ckan-solr
-install -o 108983 -g 108983 solr_data/ckan/conf/schema.xml ${SOLR_DATA}/ckan/conf/schema.xml
-install -o 108983 -g 108983 solr_data/ckan/conf/solrconfig.xml ${SOLR_DATA}/ckan/conf/solrconfig.xml
+install -o 108983 -g 108983 -m 640 solr_data/ckan/conf/schema.xml ${SOLR_DATA}/ckan/conf/schema.xml
+install -o 108983 -g 108983 -m 640 solr_data/ckan/conf/solrconfig.xml ${SOLR_DATA}/ckan/conf/solrconfig.xml
 spoc-container start ckan-solr
 
 # Configure CKAN DataPusher
-install -o 100000 -g 100000 -d ${DATAPUSHER_CONF}
-install -o 108080 -g 108080 -d ${DATAPUSHER_DATA}
-install -o 100000 -g 100000 datapusher_conf/datapusher.wsgi ${DATAPUSHER_CONF}/datapusher.wsgi
-install -o 100000 -g 100000 datapusher_conf/datapusher_settings.py ${DATAPUSHER_CONF}/datapusher_settings.py
+install -o 100000 -g 108080 -m 750 -d ${DATAPUSHER_CONF}
+install -o 108080 -g 108080 -m 750 -d ${DATAPUSHER_DATA}
+install -o 100000 -g 108080 -m 640 datapusher_conf/datapusher.wsgi ${DATAPUSHER_CONF}/datapusher.wsgi
+install -o 100000 -g 108080 -m 640 datapusher_conf/datapusher_settings.py ${DATAPUSHER_CONF}/datapusher_settings.py
 
 # Configure CKAN
-install -o 100000 -g 100000 -d ${CKAN_CONF}
-install -o 108080 -g 108080 -d ${CKAN_DATA}
+install -o 100000 -g 108080 -m 750 -d ${CKAN_CONF}
+install -o 108080 -g 108080 -m 750 -d ${CKAN_DATA}
 export CKAN_SECRET=$(head -c 18 /dev/urandom | base64 | tr -d '+/=')
 export CKAN_UUID=$(cat /proc/sys/kernel/random/uuid)
-envsubst <ckan_conf/ckan.ini | install -o 100000 -g 100000 /dev/stdin ${CKAN_CONF}/ckan.ini
-install -o 100000 -g 100000 ckan_conf/who.ini ${CKAN_CONF}/who.ini
+envsubst <ckan_conf/ckan.ini | install -o 100000 -g 108080 -m 640 /dev/stdin ${CKAN_CONF}/ckan.ini
+install -o 100000 -g 108080 -m 640 ckan_conf/who.ini ${CKAN_CONF}/who.ini
 
 # Populate database
 spoc-container exec ckan -- paster --plugin=ckan db init -c /etc/ckan/ckan.ini
diff --git a/lxc-apps/crisiscleanup/install.sh b/lxc-apps/crisiscleanup/install.sh
index dedf9ee..54902d2 100755
--- a/lxc-apps/crisiscleanup/install.sh
+++ b/lxc-apps/crisiscleanup/install.sh
@@ -10,8 +10,8 @@ install -o 105432 -g 105432 -m 700 -d ${POSTGRES_DATA}
 spoc-container exec crisiscleanup-postgres -- initdb -D /var/lib/postgresql
 
 # Configure Postgres
-install postgres_data/postgresql.conf ${POSTGRES_DATA}/postgresql.conf
-install postgres_data/pg_hba.conf ${POSTGRES_DATA}/pg_hba.conf
+install -o 105432 -g 105432 -m 600 postgres_data/postgresql.conf ${POSTGRES_DATA}/postgresql.conf
+install -o 105432 -g 105432 -m 600 postgres_data/pg_hba.conf ${POSTGRES_DATA}/pg_hba.conf
 
 # Create database
 export CRISISCLEANUP_PWD=$(head -c 18 /dev/urandom | base64 | tr -d '+/=')
@@ -26,11 +26,11 @@ export CRISISCLEANUP_ADMIN_USER="Admin"
 export CRISISCLEANUP_ADMIN_EMAIL="admin@example.com"
 export CRISISCLEANUP_ADMIN_PWD=$(head -c 12 /dev/urandom | base64 | tr -d '+/=')
 export CRISISCLEANUP_SECRET=$(spoc-container exec crisiscleanup -- rake secret)
-envsubst <cc_conf/database.yml | install -o 100000 -g 100000 /dev/stdin ${CC_CONF}/database.yml
-envsubst <cc_conf/secrets.yml | install -o 100000 -g 100000 /dev/stdin ${CC_CONF}/secrets.yml
-install -o 100000 -g 100000 cc_conf/boot.rb ${CC_CONF}/boot.rb
-install -o 100000 -g 100000 cc_conf/initializers/devise.rb ${CC_CONF}/initializers/devise.rb
-install -o 100000 -g 100000 cc_conf/environments/production.rb ${CC_CONF}/environments/production.rb
+envsubst <cc_conf/database.yml | install -o 108080 -g 108080 -m 600 /dev/stdin ${CC_CONF}/database.yml
+envsubst <cc_conf/secrets.yml | install -o 108080 -g 108080 -m 600 /dev/stdin ${CC_CONF}/secrets.yml
+install -o 108080 -g 108080 -m 640 cc_conf/boot.rb ${CC_CONF}/boot.rb
+install -o 108080 -g 108080 -m 640 cc_conf/initializers/devise.rb ${CC_CONF}/initializers/devise.rb
+install -o 108080 -g 108080 -m 640 cc_conf/environments/production.rb ${CC_CONF}/environments/production.rb
 
 # Populate database
 spoc-container exec crisiscleanup -- rake db:schema:load