diff --git a/.templates/mosquitto/docker-entrypoint.sh b/.templates/mosquitto/docker-entrypoint.sh
index cd14b0ee..7218d7e5 100644
--- a/.templates/mosquitto/docker-entrypoint.sh
+++ b/.templates/mosquitto/docker-entrypoint.sh
@@ -1,6 +1,8 @@
 #!/bin/ash
 set -e
 
+PWFILE="/mosquitto/pwfile/pwfile"
+
 # Set permissions
 user="$(id -u)"
 if [ "$user" = '0' -a -d "/mosquitto" ]; then
@@ -9,8 +11,13 @@ if [ "$user" = '0' -a -d "/mosquitto" ]; then
 
    rsync -arpv --ignore-existing /${IOTSTACK_DEFAULTS_DIR}/ "/mosquitto"
 
+   # general ownership assuming mode as set in template
    chown -Rc mosquitto:mosquitto /mosquitto
 
+   # specific requirements for the password file
+   chown -c root:root "$PWFILE"
+   chmod -c 600 "$PWFILE"
+
    echo "[IOTstack] end self-repair"
    
 fi