diff --git a/playbooks/roles/master-nameserver/tasks/main.yaml b/playbooks/roles/master-nameserver/tasks/main.yaml
index b6f4fa93b4..87fc571dba 100644
--- a/playbooks/roles/master-nameserver/tasks/main.yaml
+++ b/playbooks/roles/master-nameserver/tasks/main.yaml
@@ -19,6 +19,9 @@
   synchronize:
     src: "/opt/source/{{ item.source }}"
     dest: "/var/lib/bind/zones/{{ item.name }}"
+    rsync_opts:
+      - "--chmod=u+rwX,g+rX,o+rX"
+      - "--chown=bind:bind"
   loop: "{{ dns_zones }}"
   notify: Reload named
 - name: Install tsig key