diff --git a/linters-requirements.txt b/linters-requirements.txt
index d29346d45..67af76c76 100644
--- a/linters-requirements.txt
+++ b/linters-requirements.txt
@@ -2,4 +2,4 @@
 # conflict, like ansible version required by ansible-lint.
 flake8
 yamllint>=1.23.0
-ansible-lint>=4.3.0a1,<5
+ansible-lint>=4.3.4,<5
diff --git a/roles/configure-mirrors/tasks/mirror/CentOS-7.yaml b/roles/configure-mirrors/tasks/mirror/CentOS-7.yaml
index bcdce968a..2b4628b4b 100644
--- a/roles/configure-mirrors/tasks/mirror/CentOS-7.yaml
+++ b/roles/configure-mirrors/tasks/mirror/CentOS-7.yaml
@@ -25,3 +25,4 @@
     section: main
     option: deltarpm
     value: 0
+    mode: 0644
diff --git a/roles/configure-mirrors/tasks/mirror/CentOS-8.yaml b/roles/configure-mirrors/tasks/mirror/CentOS-8.yaml
index 83a48fffc..a9f51e244 100644
--- a/roles/configure-mirrors/tasks/mirror/CentOS-8.yaml
+++ b/roles/configure-mirrors/tasks/mirror/CentOS-8.yaml
@@ -29,3 +29,4 @@
     section: main
     option: deltarpm
     value: 0
+    mode: 0644
diff --git a/roles/configure-mirrors/tasks/mirror/Fedora.yaml b/roles/configure-mirrors/tasks/mirror/Fedora.yaml
index 2411c4e0f..550e557b2 100644
--- a/roles/configure-mirrors/tasks/mirror/Fedora.yaml
+++ b/roles/configure-mirrors/tasks/mirror/Fedora.yaml
@@ -25,3 +25,4 @@
     section: main
     option: deltarpm
     value: "false"
+    mode: 0644
diff --git a/roles/ensure-output-dirs/tasks/main.yaml b/roles/ensure-output-dirs/tasks/main.yaml
index e10f42aa9..c22b26710 100644
--- a/roles/ensure-output-dirs/tasks/main.yaml
+++ b/roles/ensure-output-dirs/tasks/main.yaml
@@ -13,6 +13,7 @@
   file:
     path: "{{ zuul_output_dir }}/{{ zj_output_dir }}"
     state: directory
+    mode: 0755
   with_items:
     - logs
     - artifacts
diff --git a/roles/fetch-output/tasks/main.yaml b/roles/fetch-output/tasks/main.yaml
index 28407891b..b9e9aff03 100644
--- a/roles/fetch-output/tasks/main.yaml
+++ b/roles/fetch-output/tasks/main.yaml
@@ -13,6 +13,7 @@
   file:
     path: "{{ zj_output_dir }}"
     state: directory
+    mode: 0755
   with_items:
     - "{{ log_path }}"
     - "{{ zuul.executor.work_root }}/artifacts"
diff --git a/roles/fetch-python-sdist-output/tasks/main.yaml b/roles/fetch-python-sdist-output/tasks/main.yaml
index c44323d0c..d79fd8232 100644
--- a/roles/fetch-python-sdist-output/tasks/main.yaml
+++ b/roles/fetch-python-sdist-output/tasks/main.yaml
@@ -16,6 +16,7 @@
   file:
     path: "{{ zuul.executor.work_root }}/artifacts"
     state: directory
+    mode: 0755
   delegate_to: localhost
 
 - name: Collect artifacts
diff --git a/roles/log-inventory/tasks/main.yaml b/roles/log-inventory/tasks/main.yaml
index b8b935c64..1d7f89f5d 100644
--- a/roles/log-inventory/tasks/main.yaml
+++ b/roles/log-inventory/tasks/main.yaml
@@ -4,6 +4,7 @@
   file:
     path: "{{ zuul_info_dir }}"
     state: directory
+    mode: 0755
 
 # We don't use the ansible inventory_file variable because it is not defined
 # for nodeless job running on the executor directly:
@@ -13,3 +14,4 @@
   copy:
     src: "{{ zuul.executor.inventory_file }}"
     dest: "{{ zuul_info_dir }}"
+    mode: 0644
diff --git a/roles/upload-afs-synchronize/tasks/main.yaml b/roles/upload-afs-synchronize/tasks/main.yaml
index 492b47f5c..6dfb49abd 100644
--- a/roles/upload-afs-synchronize/tasks/main.yaml
+++ b/roles/upload-afs-synchronize/tasks/main.yaml
@@ -4,6 +4,7 @@
   file:
     path: "{{ afs_target }}"
     state: directory
+    mode: 0755
 - name: Upload contents to AFS
   synchronize:
     src: "{{ afs_source }}"
diff --git a/roles/validate-host/tasks/main.yaml b/roles/validate-host/tasks/main.yaml
index 98da1e931..7dde4153b 100644
--- a/roles/validate-host/tasks/main.yaml
+++ b/roles/validate-host/tasks/main.yaml
@@ -8,6 +8,7 @@
   file:
     path: "{{ zuul_info_dir }}"
     state: directory
+    mode: 0755
 
 - name: Collect information about the host
   setup:
@@ -22,6 +23,7 @@
   template:
     dest: "{{ zuul_info_dir }}/host-info.{{ validate_host_hostname_sanitized }}.yaml"
     src: templates/host-info.j2
+    mode: 0644
 
 - name: zuul_debug_info block
   block:
@@ -37,5 +39,6 @@
       template:
         dest: "{{ zuul_info_dir }}/zuul-info.{{ validate_host_hostname_sanitized }}.txt"
         src: templates/zuul-info.j2
+        mode: 0644
 
   when: ansible_python_version is version('2.7', '>=')