diff --git a/bootstrap/tasks/addons/csi_driver_nfs.yaml b/bootstrap/tasks/addons/csi_driver_nfs.yaml
index ebd21ac8..c98e1df4 100644
--- a/bootstrap/tasks/addons/csi_driver_nfs.yaml
+++ b/bootstrap/tasks/addons/csi_driver_nfs.yaml
@@ -17,7 +17,7 @@
   ansible.builtin.template:
     src: "{{ item.src }}"
     dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    mode: "0755"
+    mode: "0644"
   with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
 
 # https://github.com/ansible-collections/community.sops/issues/153
@@ -27,7 +27,7 @@
       ansible.builtin.copy:
         src: "{{ repository_path }}/.sops.yaml"
         dest: "{{ repository_path }}/.sops.yaml.orig"
-        mode: "0755"
+        mode: "0644"
     - name: Remove Sops configuration file
       ansible.builtin.file:
         path: "{{ repository_path }}/.sops.yaml"
@@ -39,14 +39,14 @@
         encrypted_regex: ^(data|stringData)$
         age: ["{{ bootstrap_age_public_key }}"]
         content_yaml: "{{ lookup('ansible.builtin.template', item.src) | from_yaml }}"
-        mode: "0755"
+        mode: "0644"
         force: true
       with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
     - name: Restore Sops configuration file
       ansible.builtin.copy:
         src: "{{ repository_path }}/.sops.yaml.orig"
         dest: "{{ repository_path }}/.sops.yaml"
-        mode: "0755"
+        mode: "0644"
     - name: Remove backed up Sops configuration file
       ansible.builtin.file:
         path: "{{ repository_path }}/.sops.yaml.orig"
@@ -56,7 +56,7 @@
       ansible.builtin.copy:
         src: "{{ repository_path }}/.sops.yaml.orig"
         dest: "{{ repository_path }}/.sops.yaml"
-        mode: "0755"
+        mode: "0644"
     - name: Remove backed up Sops configuration file
       ansible.builtin.file:
         path: "{{ repository_path }}/.sops.yaml.orig"
diff --git a/bootstrap/tasks/addons/grafana.yaml b/bootstrap/tasks/addons/grafana.yaml
index 8c462779..e3f88503 100644
--- a/bootstrap/tasks/addons/grafana.yaml
+++ b/bootstrap/tasks/addons/grafana.yaml
@@ -17,7 +17,7 @@
   ansible.builtin.template:
     src: "{{ item.src }}"
     dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    mode: "0755"
+    mode: "0644"
   with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
 
 # https://github.com/ansible-collections/community.sops/issues/153
@@ -27,7 +27,7 @@
       ansible.builtin.copy:
         src: "{{ repository_path }}/.sops.yaml"
         dest: "{{ repository_path }}/.sops.yaml.orig"
-        mode: "0755"
+        mode: "0644"
     - name: Remove Sops configuration file
       ansible.builtin.file:
         path: "{{ repository_path }}/.sops.yaml"
@@ -39,14 +39,14 @@
         encrypted_regex: ^(data|stringData)$
         age: ["{{ bootstrap_age_public_key }}"]
         content_yaml: "{{ lookup('ansible.builtin.template', item.src) | from_yaml }}"
-        mode: "0755"
+        mode: "0644"
         force: true
       with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
     - name: Restore Sops configuration file
       ansible.builtin.copy:
         src: "{{ repository_path }}/.sops.yaml.orig"
         dest: "{{ repository_path }}/.sops.yaml"
-        mode: "0755"
+        mode: "0644"
     - name: Remove backed up Sops configuration file
       ansible.builtin.file:
         path: "{{ repository_path }}/.sops.yaml.orig"
@@ -56,7 +56,7 @@
       ansible.builtin.copy:
         src: "{{ repository_path }}/.sops.yaml.orig"
         dest: "{{ repository_path }}/.sops.yaml"
-        mode: "0755"
+        mode: "0644"
     - name: Remove backed up Sops configuration file
       ansible.builtin.file:
         path: "{{ repository_path }}/.sops.yaml.orig"
diff --git a/bootstrap/tasks/addons/hajimari.yaml b/bootstrap/tasks/addons/hajimari.yaml
index fd51e7f8..384e2ffe 100644
--- a/bootstrap/tasks/addons/hajimari.yaml
+++ b/bootstrap/tasks/addons/hajimari.yaml
@@ -17,7 +17,7 @@
   ansible.builtin.template:
     src: "{{ item.src }}"
     dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    mode: "0755"
+    mode: "0644"
   with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
 
 # https://github.com/ansible-collections/community.sops/issues/153
@@ -27,7 +27,7 @@
       ansible.builtin.copy:
         src: "{{ repository_path }}/.sops.yaml"
         dest: "{{ repository_path }}/.sops.yaml.orig"
-        mode: "0755"
+        mode: "0644"
     - name: Remove Sops configuration file
       ansible.builtin.file:
         path: "{{ repository_path }}/.sops.yaml"
@@ -39,14 +39,14 @@
         encrypted_regex: ^(data|stringData)$
         age: ["{{ bootstrap_age_public_key }}"]
         content_yaml: "{{ lookup('ansible.builtin.template', item.src) | from_yaml }}"
-        mode: "0755"
+        mode: "0644"
         force: true
       with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
     - name: Restore Sops configuration file
       ansible.builtin.copy:
         src: "{{ repository_path }}/.sops.yaml.orig"
         dest: "{{ repository_path }}/.sops.yaml"
-        mode: "0755"
+        mode: "0644"
     - name: Remove backed up Sops configuration file
       ansible.builtin.file:
         path: "{{ repository_path }}/.sops.yaml.orig"
@@ -56,7 +56,7 @@
       ansible.builtin.copy:
         src: "{{ repository_path }}/.sops.yaml.orig"
         dest: "{{ repository_path }}/.sops.yaml"
-        mode: "0755"
+        mode: "0644"
     - name: Remove backed up Sops configuration file
       ansible.builtin.file:
         path: "{{ repository_path }}/.sops.yaml.orig"
diff --git a/bootstrap/tasks/addons/kube_prometheus_stack.yaml b/bootstrap/tasks/addons/kube_prometheus_stack.yaml
index 495617f7..eec7ab6b 100644
--- a/bootstrap/tasks/addons/kube_prometheus_stack.yaml
+++ b/bootstrap/tasks/addons/kube_prometheus_stack.yaml
@@ -17,7 +17,7 @@
   ansible.builtin.template:
     src: "{{ item.src }}"
     dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    mode: "0755"
+    mode: "0644"
   with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
 
 # https://github.com/ansible-collections/community.sops/issues/153
@@ -27,7 +27,7 @@
       ansible.builtin.copy:
         src: "{{ repository_path }}/.sops.yaml"
         dest: "{{ repository_path }}/.sops.yaml.orig"
-        mode: "0755"
+        mode: "0644"
     - name: Remove Sops configuration file
       ansible.builtin.file:
         path: "{{ repository_path }}/.sops.yaml"
@@ -39,14 +39,14 @@
         encrypted_regex: ^(data|stringData)$
         age: ["{{ bootstrap_age_public_key }}"]
         content_yaml: "{{ lookup('ansible.builtin.template', item.src) | from_yaml }}"
-        mode: "0755"
+        mode: "0644"
         force: true
       with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
     - name: Restore Sops configuration file
       ansible.builtin.copy:
         src: "{{ repository_path }}/.sops.yaml.orig"
         dest: "{{ repository_path }}/.sops.yaml"
-        mode: "0755"
+        mode: "0644"
     - name: Remove backed up Sops configuration file
       ansible.builtin.file:
         path: "{{ repository_path }}/.sops.yaml.orig"
@@ -56,7 +56,7 @@
       ansible.builtin.copy:
         src: "{{ repository_path }}/.sops.yaml.orig"
         dest: "{{ repository_path }}/.sops.yaml"
-        mode: "0755"
+        mode: "0644"
     - name: Remove backed up Sops configuration file
       ansible.builtin.file:
         path: "{{ repository_path }}/.sops.yaml.orig"
diff --git a/bootstrap/tasks/addons/kubernetes_dashboard.yaml b/bootstrap/tasks/addons/kubernetes_dashboard.yaml
index 97a9b2ba..1d24c394 100644
--- a/bootstrap/tasks/addons/kubernetes_dashboard.yaml
+++ b/bootstrap/tasks/addons/kubernetes_dashboard.yaml
@@ -17,7 +17,7 @@
   ansible.builtin.template:
     src: "{{ item.src }}"
     dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    mode: "0755"
+    mode: "0644"
   with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
 
 # https://github.com/ansible-collections/community.sops/issues/153
@@ -27,7 +27,7 @@
       ansible.builtin.copy:
         src: "{{ repository_path }}/.sops.yaml"
         dest: "{{ repository_path }}/.sops.yaml.orig"
-        mode: "0755"
+        mode: "0644"
     - name: Remove Sops configuration file
       ansible.builtin.file:
         path: "{{ repository_path }}/.sops.yaml"
@@ -39,14 +39,14 @@
         encrypted_regex: ^(data|stringData)$
         age: ["{{ bootstrap_age_public_key }}"]
         content_yaml: "{{ lookup('ansible.builtin.template', item.src) | from_yaml }}"
-        mode: "0755"
+        mode: "0644"
         force: true
       with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
     - name: Restore Sops configuration file
       ansible.builtin.copy:
         src: "{{ repository_path }}/.sops.yaml.orig"
         dest: "{{ repository_path }}/.sops.yaml"
-        mode: "0755"
+        mode: "0644"
     - name: Remove backed up Sops configuration file
       ansible.builtin.file:
         path: "{{ repository_path }}/.sops.yaml.orig"
@@ -56,7 +56,7 @@
       ansible.builtin.copy:
         src: "{{ repository_path }}/.sops.yaml.orig"
         dest: "{{ repository_path }}/.sops.yaml"
-        mode: "0755"
+        mode: "0644"
     - name: Remove backed up Sops configuration file
       ansible.builtin.file:
         path: "{{ repository_path }}/.sops.yaml.orig"
diff --git a/bootstrap/tasks/addons/weave_gitops.yaml b/bootstrap/tasks/addons/weave_gitops.yaml
index 4df1f56f..a62d6b9f 100644
--- a/bootstrap/tasks/addons/weave_gitops.yaml
+++ b/bootstrap/tasks/addons/weave_gitops.yaml
@@ -17,7 +17,7 @@
   ansible.builtin.template:
     src: "{{ item.src }}"
     dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    mode: "0755"
+    mode: "0644"
   with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
 
 # https://github.com/ansible-collections/community.sops/issues/153
@@ -27,7 +27,7 @@
       ansible.builtin.copy:
         src: "{{ repository_path }}/.sops.yaml"
         dest: "{{ repository_path }}/.sops.yaml.orig"
-        mode: "0755"
+        mode: "0644"
     - name: Remove Sops configuration file
       ansible.builtin.file:
         path: "{{ repository_path }}/.sops.yaml"
@@ -39,14 +39,14 @@
         encrypted_regex: ^(data|stringData)$
         age: ["{{ bootstrap_age_public_key }}"]
         content_yaml: "{{ lookup('ansible.builtin.template', item.src) | from_yaml }}"
-        mode: "0755"
+        mode: "0644"
         force: true
       with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
     - name: Restore Sops configuration file
       ansible.builtin.copy:
         src: "{{ repository_path }}/.sops.yaml.orig"
         dest: "{{ repository_path }}/.sops.yaml"
-        mode: "0755"
+        mode: "0644"
     - name: Remove backed up Sops configuration file
       ansible.builtin.file:
         path: "{{ repository_path }}/.sops.yaml.orig"
@@ -56,7 +56,7 @@
       ansible.builtin.copy:
         src: "{{ repository_path }}/.sops.yaml.orig"
         dest: "{{ repository_path }}/.sops.yaml"
-        mode: "0755"
+        mode: "0644"
     - name: Remove backed up Sops configuration file
       ansible.builtin.file:
         path: "{{ repository_path }}/.sops.yaml.orig"
diff --git a/bootstrap/tasks/ansible/main.yaml b/bootstrap/tasks/ansible/main.yaml
index a6902192..bd2898dd 100644
--- a/bootstrap/tasks/ansible/main.yaml
+++ b/bootstrap/tasks/ansible/main.yaml
@@ -12,7 +12,7 @@
   ansible.builtin.template:
     src: "{{ item.src }}"
     dest: "{{ repository_path }}/ansible/{{ item.path | regex_replace('.j2$', '') }}"
-    mode: "0755"
+    mode: "0644"
   with_community.general.filetree: ["../templates/ansible/"]
 
 # https://github.com/ansible-collections/community.sops/issues/153
@@ -22,7 +22,7 @@
       ansible.builtin.copy:
         src: "{{ repository_path }}/.sops.yaml"
         dest: "{{ repository_path }}/.sops.yaml.orig"
-        mode: "0755"
+        mode: "0644"
     - name: Remove Sops configuration file
       ansible.builtin.file:
         path: "{{ repository_path }}/.sops.yaml"
@@ -34,7 +34,7 @@
         encrypted_regex: ^(data|stringData)$
         age: ["{{ bootstrap_age_public_key }}"]
         content_yaml: "{{ lookup('ansible.builtin.template', item.src) | from_yaml }}"
-        mode: "0755"
+        mode: "0644"
         force: true
       with_community.general.filetree: ["../templates/ansible/"]
     - name: Template encrypted node secrets
@@ -42,7 +42,7 @@
         path: "{{ repository_path }}/ansible/inventory/host_vars/{{ item.name }}.sops.yaml"
         age: ["{{ bootstrap_age_public_key }}"]
         content_yaml: "{{ lookup('ansible.builtin.template', 'templates/node.sops.yaml.j2', template_vars=dict(password=item.password)) | from_yaml }}"
-        mode: "0755"
+        mode: "0644"
         force: true
       loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker | default([]) }}"
       loop_control:
@@ -51,7 +51,7 @@
       ansible.builtin.copy:
         src: "{{ repository_path }}/.sops.yaml.orig"
         dest: "{{ repository_path }}/.sops.yaml"
-        mode: "0755"
+        mode: "0644"
     - name: Remove backed up Sops configuration file
       ansible.builtin.file:
         path: "{{ repository_path }}/.sops.yaml.orig"
@@ -61,61 +61,8 @@
       ansible.builtin.copy:
         src: "{{ repository_path }}/.sops.yaml.orig"
         dest: "{{ repository_path }}/.sops.yaml"
-        mode: "0755"
+        mode: "0644"
     - name: Remove backed up Sops configuration file
       ansible.builtin.file:
         path: "{{ repository_path }}/.sops.yaml.orig"
         state: absent
-
-# - name: Template Ansible configuration
-#   ansible.builtin.template:
-#     src: "{{ item.src }}"
-#     dest: "{{ repository_path }}/{{ item.dest }}"
-#     mode: "0755"
-#   loop:
-#     - src: templates/ansible/supplemental.yaml.j2
-#       dest: ./ansible/inventory/group_vars/kubernetes/supplemental.yaml
-#     - src: templates/ansible/hosts.yaml.j2
-#       dest: ./ansible/inventory/hosts.yaml
-
-# # https://github.com/ansible-collections/community.sops/issues/153
-# - name: Template Ansible encrypted files
-#   block:
-#     - name: Rename Sops configuration file
-#       ansible.builtin.copy:
-#         src: "{{ repository_path }}/.sops.yaml"
-#         dest: "{{ repository_path }}/.sops.yaml.orig"
-#         mode: "0755"
-#     - name: Remove Sops configuration file
-#       ansible.builtin.file:
-#         path: "{{ repository_path }}/.sops.yaml"
-#         state: absent
-#     - name: Template encrypted node secrets
-#       community.sops.sops_encrypt:
-#         path: "{{ repository_path }}/ansible/inventory/host_vars/{{ item.name }}.sops.yaml"
-#         age: ["{{ bootstrap_age_public_key }}"]
-#         content_yaml: "{{ lookup('ansible.builtin.template', 'templates/ansible/node.sops.yaml.j2', template_vars=dict(password=item.password)) | from_yaml }}"
-#         mode: "0755"
-#         force: true
-#       loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker | default([]) }}"
-#       loop_control:
-#         label: "{{ item.address }}"
-#     - name: Restore Sops configuration file
-#       ansible.builtin.copy:
-#         src: "{{ repository_path }}/.sops.yaml.orig"
-#         dest: "{{ repository_path }}/.sops.yaml"
-#         mode: "0755"
-#     - name: Remove backed up Sops configuration file
-#       ansible.builtin.file:
-#         path: "{{ repository_path }}/.sops.yaml.orig"
-#         state: absent
-#   rescue:
-#     - name: Restore Sops configuration file
-#       ansible.builtin.copy:
-#         src: "{{ repository_path }}/.sops.yaml.orig"
-#         dest: "{{ repository_path }}/.sops.yaml"
-#         mode: "0755"
-#     - name: Remove backed up Sops configuration file
-#       ansible.builtin.file:
-#         path: "{{ repository_path }}/.sops.yaml.orig"
-#         state: absent
diff --git a/bootstrap/tasks/kubernetes/main.yaml b/bootstrap/tasks/kubernetes/main.yaml
index c6da200f..ab475c63 100644
--- a/bootstrap/tasks/kubernetes/main.yaml
+++ b/bootstrap/tasks/kubernetes/main.yaml
@@ -12,7 +12,7 @@
   ansible.builtin.template:
     src: "{{ item.src }}"
     dest: "{{ repository_path }}/kubernetes/{{ item.path | regex_replace('.j2$', '') }}"
-    mode: "0755"
+    mode: "0644"
   with_community.general.filetree: ["../templates/kubernetes/"]
 
 # https://github.com/ansible-collections/community.sops/issues/153
@@ -22,7 +22,7 @@
       ansible.builtin.copy:
         src: "{{ repository_path }}/.sops.yaml"
         dest: "{{ repository_path }}/.sops.yaml.orig"
-        mode: "0755"
+        mode: "0644"
     - name: Remove Sops configuration file
       ansible.builtin.file:
         path: "{{ repository_path }}/.sops.yaml"
@@ -34,14 +34,14 @@
         encrypted_regex: ^(data|stringData)$
         age: ["{{ bootstrap_age_public_key }}"]
         content_yaml: "{{ lookup('ansible.builtin.template', item.src) | from_yaml }}"
-        mode: "0755"
+        mode: "0644"
         force: true
       with_community.general.filetree: ["../templates/kubernetes/"]
     - name: Restore Sops configuration file
       ansible.builtin.copy:
         src: "{{ repository_path }}/.sops.yaml.orig"
         dest: "{{ repository_path }}/.sops.yaml"
-        mode: "0755"
+        mode: "0644"
     - name: Remove backed up Sops configuration file
       ansible.builtin.file:
         path: "{{ repository_path }}/.sops.yaml.orig"
@@ -51,7 +51,7 @@
       ansible.builtin.copy:
         src: "{{ repository_path }}/.sops.yaml.orig"
         dest: "{{ repository_path }}/.sops.yaml"
-        mode: "0755"
+        mode: "0644"
     - name: Remove backed up Sops configuration file
       ansible.builtin.file:
         path: "{{ repository_path }}/.sops.yaml.orig"
diff --git a/bootstrap/tasks/sops/main.yaml b/bootstrap/tasks/sops/main.yaml
index b8fd2f32..7aaaf6b9 100644
--- a/bootstrap/tasks/sops/main.yaml
+++ b/bootstrap/tasks/sops/main.yaml
@@ -3,4 +3,4 @@
   ansible.builtin.template:
     src: "templates/.sops.yaml.j2"
     dest: "{{ repository_path }}/.sops.yaml"
-    mode: "0755"
+    mode: "0644"