diff --git a/changelog/unreleased/pr-491.toml b/changelog/unreleased/pr-491.toml
new file mode 100644
index 0000000..346a03e
--- /dev/null
+++ b/changelog/unreleased/pr-491.toml
@@ -0,0 +1,4 @@
+type = "f"
+message = "Fix default permissions on `/etc/graylog/sidecar/sidecar.yml` file."
+
+pulls = ["491"]
diff --git a/dist/recipe.rb b/dist/recipe.rb
index b6cda8a..162843a 100644
--- a/dist/recipe.rb
+++ b/dist/recipe.rb
@@ -27,6 +27,7 @@ def install
     lib('graylog-sidecar').install '../../collectors/filebeat/linux/x86_64/filebeat'
     lib('graylog-sidecar').install '../../collectors/auditbeat/linux/x86_64/auditbeat'
     etc('graylog/sidecar').install '../../../sidecar-example.yml', 'sidecar.yml'
+    etc('graylog/sidecar/sidecar.yml').chmod(0600)
     var('lib/graylog-sidecar/generated').mkdir
     var('log/graylog-sidecar').mkdir
     var('run/graylog-sidecar').mkdir
diff --git a/dist/recipe32.rb b/dist/recipe32.rb
index a138523..87499d8 100644
--- a/dist/recipe32.rb
+++ b/dist/recipe32.rb
@@ -27,6 +27,7 @@ def install
     lib('graylog-sidecar').install '../../collectors/filebeat/linux/x86/filebeat'
     lib('graylog-sidecar').install '../../collectors/auditbeat/linux/x86/auditbeat'
     etc('graylog/sidecar').install '../../../sidecar-example.yml', 'sidecar.yml'
+    etc('graylog/sidecar/sidecar.yml').chmod(0600)
     var('lib/graylog-sidecar/generated').mkdir
     var('log/graylog-sidecar').mkdir
     var('run/graylog-sidecar').mkdir
diff --git a/dist/recipearm64.rb b/dist/recipearm64.rb
index b96b4a4..de8e397 100644
--- a/dist/recipearm64.rb
+++ b/dist/recipearm64.rb
@@ -27,6 +27,7 @@ def install
     lib('graylog-sidecar').install '../../collectors/filebeat/linux/arm64/filebeat'
     lib('graylog-sidecar').install '../../collectors/auditbeat/linux/arm64/auditbeat'
     etc('graylog/sidecar').install '../../../sidecar-example.yml', 'sidecar.yml'
+    etc('graylog/sidecar/sidecar.yml').chmod(0600)
     var('lib/graylog-sidecar/generated').mkdir
     var('log/graylog-sidecar').mkdir
     var('run/graylog-sidecar').mkdir
diff --git a/dist/recipearmv7.rb b/dist/recipearmv7.rb
index e0b2d73..41c13d1 100644
--- a/dist/recipearmv7.rb
+++ b/dist/recipearmv7.rb
@@ -25,6 +25,7 @@ def build
   def install
     bin.install 'graylog-sidecar'
     etc('graylog/sidecar').install '../../../sidecar-example.yml', 'sidecar.yml'
+    etc('graylog/sidecar/sidecar.yml').chmod(0600)
     var('lib/graylog-sidecar/generated').mkdir
     var('log/graylog-sidecar').mkdir
     var('run/graylog-sidecar').mkdir