diff --git a/glue/main.go b/glue/main.go
index 4f4b3bf..e4e86f1 100644
--- a/glue/main.go
+++ b/glue/main.go
@@ -655,6 +655,18 @@ func (p *Processor) SaveMetadata(metadata string) error {
 		return err
 	}
 
+	// Set permissions
+	err = os.Chmod(path.Join(volumePath, ".metadata.json"), 0600)
+	if err != nil {
+		return err
+	}
+
+	// Set owner
+	err = os.Chown(path.Join(volumePath, ".metadata.json"), ownerUID, ownerGID)
+	if err != nil {
+		return err
+	}
+
 	return nil
 }
 
diff --git a/glue/types.go b/glue/types.go
index 98e16c1..88b2741 100644
--- a/glue/types.go
+++ b/glue/types.go
@@ -2,6 +2,9 @@ package glue
 
 import "github.com/rosti-cz/node-api/apps"
 
+const ownerUID = 1000
+const ownerGID = 1000
+
 // Path where authorized keys are
 const sshPubKeysLocation = "/srv/.ssh/authorized_keys"