diff --git a/tasks/main.yml b/tasks/main.yml
index 1d24d9e..bc9eb17 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -14,11 +14,13 @@
   ansible.builtin.file:
     state: directory
     path: "{{ ubuntu_installer_target_dir }}"
+    mode: 0750
 
 - name: Fetch source ISO
   ansible.builtin.get_url:
     url: "{{ ubuntu_installer_image_url }}"
     dest: "{{ ubuntu_installer_iso_path }}"
+    mode: 0640
 
 - name: Extract ISO contents
   ansible.builtin.command: "7z -y x {{ ubuntu_installer_iso_path }} -o{{ tmpdir_dest.path }}"
@@ -33,18 +35,20 @@
   ansible.builtin.file:
     dest: "{{ tmpdir_dest.path }}{{ ubuntu_installer_cloudinit }}"
     state: directory
+    mode: 0755
 
 - name: Set interface prefix
   ansible.builtin.set_fact:
-    ubuntu_installer_interface_prefix: "{{ ubuntu_installer_interface_ip | ipaddr('prefix') }}"
+    ubuntu_installer_interface_prefix: "{{ _interface_ip | ipaddr('prefix') }}"
   vars:
-    ubuntu_installer_interface_ip: "{{ ubuntu_installer_interface.ipaddress }}/{{ ubuntu_installer_interface.netmask }}"
+    _interface_ip: "{{ ubuntu_installer_interface.ipaddress }}/{{ ubuntu_installer_interface.netmask }}"
   when: ubuntu_installer_interface.static | bool
 
 - name: Create cloud-init user data
   ansible.builtin.template:
     src: "user-data.j2"
     dest: "{{ tmpdir_dest.path }}{{ ubuntu_installer_cloudinit }}/user-data"
+    mode: 0640
   vars:
     _ssh_user: "{{ ubuntu_installer_username }}"
     _ssh_pass: "{{ ubuntu_installer_password }}"
@@ -58,12 +62,13 @@
     _mirror_security: "{{ ubuntu_installer_security_mirror }}"
     _packages: "{{ ubuntu_installer_image_packages }}"
     _storage_layout: "{{ __ubuntu_installer_live_storage_map[ubuntu_installer_partman_method] }}"
-    _storage_config: "{{ ubuntu_installer_live_storage | default(__ubuntu_installer_live_storage[ubuntu_installer_partman_method]) }}"
+    _storage_config: "{{ ubuntu_installer_live_storage | default(_storage_layout) }}"
 
 - name: Create cloud-init meta data
   ansible.builtin.file:
     dest: "{{ tmpdir_dest.path }}{{ ubuntu_installer_cloudinit }}/meta-data"
     state: touch
+    mode: 0660
 
 - name: Detect isolinux bootloader
   ansible.builtin.stat:
@@ -86,6 +91,7 @@
       }
 
       grub_platform
+    mode: 0664
   vars:
     nocloud_dir: "{{ ubuntu_installer_cloudinit }}"
 
@@ -102,6 +108,7 @@
       ansible.builtin.template:
         src: isolinux.live.j2
         dest: "{{ tmpdir_dest.path }}/isolinux/txt.cfg"
+        mode: 0640
       vars:
         kernel_file: /casper/vmlinuz
         initrd_file: /casper/initrd