diff --git a/plugins/nginx-vhosts/install b/plugins/nginx-vhosts/install
index 88b4e6e68..a9a1f0fd2 100755
--- a/plugins/nginx-vhosts/install
+++ b/plugins/nginx-vhosts/install
@@ -24,6 +24,7 @@ trigger-nginx-vhosts-install() {
     NGINX_SUDOERS_FILE="/etc/sudoers.d/dokku-openresty"
   fi
 
+  local mode="0440"
   case "$DOKKU_DISTRO" in
     debian | raspbian)
       echo "%dokku ALL=(ALL) NOPASSWD:/usr/sbin/invoke-rc.d $NGINX_INIT_NAME reload, $NGINX_BIN -t, ${NGINX_BIN} -t -c *" >"$NGINX_SUDOERS_FILE"
@@ -48,10 +49,11 @@ trigger-nginx-vhosts-install() {
     centos | fedora | rhel)
       echo "%dokku ALL=(ALL) NOPASSWD:/usr/bin/systemctl reload $NGINX_INIT_NAME, $NGINX_BIN -t, $NGINX_BIN -t -c *" >"$NGINX_SUDOERS_FILE"
       echo "Defaults:dokku !requiretty" >>"$NGINX_SUDOERS_FILE"
+      mode="0600"
       ;;
   esac
 
-  chmod 0440 "$NGINX_SUDOERS_FILE"
+  chmod "$mode" "$NGINX_SUDOERS_FILE"
 
   # if dhparam.pem has not been created, create it the first time
   if [[ ! -f "$NGINX_ROOT/dhparam.pem" ]]; then
diff --git a/plugins/storage/install b/plugins/storage/install
index bda82c024..cad455d0d 100755
--- a/plugins/storage/install
+++ b/plugins/storage/install
@@ -10,7 +10,7 @@ trigger-storage-install() {
   chown dokku:dokku "${storage_directory}"
 
   STORAGE_SUDOERS_FILE="/etc/sudoers.d/dokku-storage"
-
+  local mode="0440"
   case "$DOKKU_DISTRO" in
     arch | debian | opensuse | raspbian | ubuntu)
       echo "%dokku ALL=(ALL) NOPASSWD:$PLUGIN_AVAILABLE_PATH/storage/bin/chown-storage-dir *" >"$STORAGE_SUDOERS_FILE"
@@ -21,9 +21,11 @@ trigger-storage-install() {
       echo "%dokku ALL=(ALL) NOPASSWD:$PLUGIN_AVAILABLE_PATH/storage/bin/chown-storage-dir *" >"$STORAGE_SUDOERS_FILE"
       echo "Defaults:dokku !requiretty" >>"$STORAGE_SUDOERS_FILE"
       echo "Defaults env_keep += \"DOKKU_LIB_ROOT\"" >>"$STORAGE_SUDOERS_FILE"
-
+      mode="0600"
       ;;
   esac
+
+  chmod "$mode" "$STORAGE_SUDOERS_FILE"
 }
 
 trigger-storage-install "$@"