diff --git a/modules/nixos/clicks/security/secrets/groupPerms/default.nix b/modules/nixos/clicks/security/secrets/groupPerms/default.nix
new file mode 100644
index 0000000..1f176ac
--- /dev/null
+++ b/modules/nixos/clicks/security/secrets/groupPerms/default.nix
@@ -0,0 +1,27 @@
+{ config, lib, ... }: {
+  options.clicks.security.secrets.groupPerms.enable = lib.mkOption {
+    description = ''
+      Enable setting permissions for age secrets to 0440 rather than 0400 by
+      default, allowing group access
+
+      The default age permissions for secrets block the "group" from accessing
+      the secret, making that option useless without additionally specifying a
+      mode
+      '';
+    type = lib.types.bool;
+    default = config.clicks.security.secrets.enable;
+  };
+
+  options.age = {
+    secrets = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.submodule (submodule: {
+        config = {
+          mode = lib.pipe "0440" [
+            (lib.mkOverride 999)
+            (lib.mkIf config.clicks.security.secrets.groupPerms.enable)
+          ];
+        };
+      }));
+    };
+  };
+}
diff --git a/systems/x86_64-linux/teal/default.nix b/systems/x86_64-linux/teal/default.nix
index 0bd7bd4..4cceeca 100644
--- a/systems/x86_64-linux/teal/default.nix
+++ b/systems/x86_64-linux/teal/default.nix
@@ -294,21 +294,17 @@
   age.secrets."clicks.services.headscale.oidc.client_secret_path" = {
     rekeyFile = ./clicks.services.headscale.oidc.client_secret_path.age;
     group = "headscale";
-    mode = "440";
   };
   age.secrets."clicks.services.headscale.database_password_path" = {
     rekeyFile = ./clicks.services.headscale.database_password_path.age;
     group = "headscale";
-    mode = "440";
   };
   age.secrets."clicks.services.headscale.noise_private_key_path" = {
     rekeyFile = ./clicks.services.headscale.noise_private_key_path.age;
     group = "headscale";
-    mode = "440";
   };
   age.secrets."clicks.services.headscale.private_key_path" = {
     rekeyFile = ./clicks.services.headscale.private_key_path.age;
     group = "headscale";
-    mode = "440";
   };
 }