diff --git a/bundles/wireguard/items.py b/bundles/wireguard/items.py
index c920151..37d018b 100644
--- a/bundles/wireguard/items.py
+++ b/bundles/wireguard/items.py
@@ -18,6 +18,8 @@ for number, (peer, config) in enumerate(sorted(node.metadata.get('wireguard/peer
     files[f'/etc/systemd/network/wg{number}.netdev'] = {
         'content_type': 'mako',
         'source': 'wg.netdev',
+        'owner': 'systemd-network',
+        'mode': '0600',
         'context': {
             'endpoint': config.get('endpoint'),
             'number': number,