diff --git a/handlers/main.yml b/handlers/main.yml
index d9b4d6c9..9a8cbc3c 100644
--- a/handlers/main.yml
+++ b/handlers/main.yml
@@ -45,6 +45,9 @@
   copy:
     src: "/etc/glance/policy.json-{{ glance_venv_tag }}"
     dest: "/etc/glance/policy.json"
+    owner: "root"
+    group: "{{ glance_system_group_name }}"
+    mode: "0640"
     remote_src: yes
 
 - name: Start services