diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix
index 4742877a7..2f9828bb0 100644
--- a/krebs/4lib/types.nix
+++ b/krebs/4lib/types.nix
@@ -163,7 +163,7 @@ types // rec {
   secret-file = submodule ({ config, ... }: {
     options = {
       path = mkOption { type = str; };
-      mode = mkOption { type = str; default = "0400"; };
+      mode = mkOption { type = file-mode; default = "0400"; };
       owner = mkOption {
         type = user;
         default = config.krebs.users.root;
@@ -293,6 +293,12 @@ types // rec {
     };
   };
 
+  file-mode = mkOptionType {
+    name = "file mode";
+    check = x: isString x && match "[0-7]{4}" x != null;
+    merge = mergeOneOption;
+  };
+
   haskell.conid = mkOptionType {
     name = "Haskell constructor identifier";
     check = x: