diff --git a/operator/pkg/deployment/backup.go b/operator/pkg/deployment/backup.go
index 2f7dd1be..a122b899 100644
--- a/operator/pkg/deployment/backup.go
+++ b/operator/pkg/deployment/backup.go
@@ -79,7 +79,7 @@ func NewBackupDaemonDeployment(backupDaemon *netcrackerv1.BackupDaemon, pgCluste
 							VolumeSource: corev1.VolumeSource{
 								Secret: &corev1.SecretVolumeSource{
 									SecretName: "postgres-credentials",
-									DefaultMode: ptr.To[int32](0400),
+									DefaultMode: ptr.To[int32](420),
 								},
 							},
 						},
@@ -88,7 +88,7 @@ func NewBackupDaemonDeployment(backupDaemon *netcrackerv1.BackupDaemon, pgCluste
 							VolumeSource: corev1.VolumeSource{
 								Secret: &corev1.SecretVolumeSource{
 									SecretName: "replicator-credentials",
-									DefaultMode: ptr.To[int32](0400),
+									DefaultMode: ptr.To[int32](420),
 								},
 							},
 						},
@@ -305,7 +305,7 @@ func NewBackupDaemonDeployment(backupDaemon *netcrackerv1.BackupDaemon, pgCluste
           VolumeSource: corev1.VolumeSource{
               Secret: &corev1.SecretVolumeSource{
                   SecretName:  GetRootSecretName(pgClusterName),
-                  DefaultMode: ptr.To[int32](0400),
+                  DefaultMode: ptr.To[int32](420),
               },
           },
       },
@@ -314,7 +314,7 @@ func NewBackupDaemonDeployment(backupDaemon *netcrackerv1.BackupDaemon, pgCluste
           VolumeSource: corev1.VolumeSource{
               Secret: &corev1.SecretVolumeSource{
                   SecretName:  "replicator-credentials",
-                  DefaultMode: ptr.To[int32](0400),
+                  DefaultMode: ptr.To[int32](420),
               },
           },
       },
diff --git a/operator/pkg/deployment/monitoring.go b/operator/pkg/deployment/monitoring.go
index 39c84199..8622e959 100644
--- a/operator/pkg/deployment/monitoring.go
+++ b/operator/pkg/deployment/monitoring.go
@@ -82,7 +82,7 @@ func NewMonitoringDeployment(metricCollector *netcrackerv1.MetricCollector, pgcl
 							VolumeSource: corev1.VolumeSource{
 								Secret: &corev1.SecretVolumeSource{
 									SecretName:  MetricCollectorUserCredentials,
-									DefaultMode: ptr.To[int32](0400),
+									DefaultMode: ptr.To[int32](420),
 								},
 							},
 						},
@@ -91,7 +91,7 @@ func NewMonitoringDeployment(metricCollector *netcrackerv1.MetricCollector, pgcl
 							VolumeSource: corev1.VolumeSource{
 								Secret: &corev1.SecretVolumeSource{
 									SecretName:  influxDbAdminCredentials,
-									DefaultMode: ptr.To[int32](0400),
+									DefaultMode: ptr.To[int32](420),
 								},
 							},
 						},
@@ -100,7 +100,7 @@ func NewMonitoringDeployment(metricCollector *netcrackerv1.MetricCollector, pgcl
 							VolumeSource: corev1.VolumeSource{
 								Secret: &corev1.SecretVolumeSource{
 									SecretName:  "postgres-credentials",
-									DefaultMode: ptr.To[int32](0400),
+									DefaultMode: ptr.To[int32](420),
 								},
 							},
 						},
diff --git a/operator/pkg/reconciler/backup_daemon.go b/operator/pkg/reconciler/backup_daemon.go
index 1a5c43ac..1603f3be 100644
--- a/operator/pkg/reconciler/backup_daemon.go
+++ b/operator/pkg/reconciler/backup_daemon.go
@@ -174,7 +174,7 @@ func (r *BackupDaemonReconciler) Reconcile() error {
 					VolumeSource: corev1.VolumeSource{
 						Secret: &corev1.SecretVolumeSource{
 							SecretName: awsCredentialsSecretName,
-							DefaultMode: ptr.To[int32](0400),
+							DefaultMode: ptr.To[int32](420),
 						},
 					},
 				})
@@ -205,7 +205,7 @@ func (r *BackupDaemonReconciler) Reconcile() error {
 				VolumeSource: corev1.VolumeSource{
 					Secret: &corev1.SecretVolumeSource{
 						SecretName: s3StorageCredentialsSecretName,
-						DefaultMode: ptr.To[int32](0400),
+						DefaultMode: ptr.To[int32](420),
 					},
 				},
 			})
diff --git a/operator/pkg/replicationcontroller/replication_controller.go b/operator/pkg/replicationcontroller/replication_controller.go
index d4f227a1..cfbae6a7 100644
--- a/operator/pkg/replicationcontroller/replication_controller.go
+++ b/operator/pkg/replicationcontroller/replication_controller.go
@@ -64,7 +64,7 @@ func NewRCDeployment(cr v1.PatroniServices, sa, clusterName string, pgPort int)
 							VolumeSource: corev1.VolumeSource{
 								Secret: &corev1.SecretVolumeSource{
 									SecretName:  "postgres-credentials",
-									DefaultMode: ptr.To[int32](0400),
+									DefaultMode: ptr.To[int32](420),
 								},
 							},
 						},
@@ -73,7 +73,7 @@ func NewRCDeployment(cr v1.PatroniServices, sa, clusterName string, pgPort int)
 							VolumeSource: corev1.VolumeSource{
 								Secret: &corev1.SecretVolumeSource{
 									SecretName:  "logical-replication-controller-creds",
-									DefaultMode: ptr.To[int32](0400),
+									DefaultMode: ptr.To[int32](420),
 								},
 							},
 						},