diff --git a/roles/head-prep/tasks/main.yml b/roles/head-prep/tasks/main.yml
index 768390e..4b27b39 100644
--- a/roles/head-prep/tasks/main.yml
+++ b/roles/head-prep/tasks/main.yml
@@ -63,3 +63,9 @@
     dest={{ ansible_user_dir }}/.ansible.cfg
     owner={{ ansible_user_id }} mode=0644
 
+- name: Open permissions on MaaS node key
+  file:
+    src={{ maas_node_key }}
+    owner=root
+    mode=0444
+  when: on_maas