diff --git a/mumble.changes b/mumble.changes
index 7d43b81..a1476f7 100644
--- a/mumble.changes
+++ b/mumble.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Wed Nov  6 16:15:46 UTC 2019 - opensuse@trummer.xyz
+
+- set permissions of config file to 640 because it can contain passwords
+
 -------------------------------------------------------------------
 Wed Sep 11 22:45:27 UTC 2019 - Christophe Giboudeaux <christophe@krop.fr>
 
diff --git a/mumble.spec b/mumble.spec
index 97d03f0..a107972 100644
--- a/mumble.spec
+++ b/mumble.spec
@@ -285,7 +285,7 @@ install -d -m 0755 %{buildroot}%{_bindir}
 # sense in that case. So use link to avoid the profile.
 ln -s %{_sbindir}/murmurd %{buildroot}%{_bindir}/murmurd
 install -D -m 0644 scripts/murmur.conf %{buildroot}%{_sysconfdir}/dbus-1/system.d/mumble-server.conf
-install -D -m 0644 scripts/murmur.ini %{buildroot}%{_sysconfdir}/mumble-server.ini
+install -D -m 0640 scripts/murmur.ini %{buildroot}%{_sysconfdir}/mumble-server.ini
 # fix up config file
 sed -i -e 's/^dbus=session/dbus=system/' \
         -e 's/#uname=/uname=mumble-server/' \