diff --git a/manifests/params.pp b/manifests/params.pp
index c857be9..1f9de6a 100644
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -25,8 +25,8 @@
       $distrusted_cert_dir = '/etc/pki/ca-trust/source/blacklist'
       $update_cmd          = 'update-ca-trust extract'
       $cert_dir_group      = 'root'
-      $cert_dir_mode       = '0555'
-      $ca_file_mode        = '0444'
+      $cert_dir_mode       = '0755'
+      $ca_file_mode        = '0644'
       $ca_file_extension   = 'crt'
       $package_name        = 'ca-certificates'
     }
@@ -35,8 +35,8 @@
       $distrusted_cert_dir = '/etc/ca-certificates/trust-source/blacklist'
       $update_cmd          = 'trust extract-compat'
       $cert_dir_group      = 'root'
-      $cert_dir_mode       = '0555'
-      $ca_file_mode        = '0444'
+      $cert_dir_mode       = '0755'
+      $ca_file_mode        = '0644'
       $ca_file_extension   = 'crt'
       $package_name        = 'ca-certificates'
     }
@@ -55,8 +55,8 @@
         $package_name        = 'ca-certificates'
       }
       $cert_dir_group        = 'root'
-      $cert_dir_mode         = '0555'
-      $ca_file_mode          = '0444'
+      $cert_dir_mode         = '0755'
+      $ca_file_mode          = '0644'
     }
     default: {
       fail("Unsupported osfamily (${::osfamily})")