diff --git a/sdk_container/src/third_party/coreos-overlay/app-crypt/trousers/files/tmpfiles.d/trousers.conf b/sdk_container/src/third_party/coreos-overlay/app-crypt/trousers/files/tmpfiles.d/trousers.conf
index c1c39895e7..ad2171ad3d 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-crypt/trousers/files/tmpfiles.d/trousers.conf
+++ b/sdk_container/src/third_party/coreos-overlay/app-crypt/trousers/files/tmpfiles.d/trousers.conf
@@ -1,3 +1,3 @@
 d /var/lib/tpm 0755 tss tss - -
-C /etc/tcsd.conf 0600 tss tss - /usr/share/trousers/tcsd.conf
+C /etc/tcsd.conf 0640 root tss - /usr/share/trousers/tcsd.conf
 C /var/lib/tpm/system.data 0600 tss tss - /usr/share/trousers/system.data
diff --git a/sdk_container/src/third_party/coreos-overlay/app-crypt/trousers/trousers-0.3.14-r2.ebuild b/sdk_container/src/third_party/coreos-overlay/app-crypt/trousers/trousers-0.3.14-r2.ebuild
index e44447e41d..fce278c35c 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-crypt/trousers/trousers-0.3.14-r2.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/app-crypt/trousers/trousers-0.3.14-r2.ebuild
@@ -67,7 +67,7 @@ src_install() {
 	use doc && dodoc doc/*
 	# Flatcar:
 	# (removed newinitd and newconfd)
-	fowners tss:tss /etc/tcsd.conf
+	fowners root:tss /etc/tcsd.conf
 
 	systemd_dounit "${FILESDIR}"/tcsd.service
 
@@ -84,6 +84,6 @@ src_install() {
 	# stash a copy of the config so we can restore it from tmpfiles
 	doins "${D}"/etc/tcsd.conf
 	fowners tss:tss /usr/share/trousers/system.data
-	fowners tss:tss /usr/share/trousers/tcsd.conf
+	fowners root:tss /usr/share/trousers/tcsd.conf
 	systemd_dotmpfilesd "${FILESDIR}"/tmpfiles.d/trousers.conf
 }