diff --git a/roles/lmn_vm/files/desktop-sync b/roles/lmn_vm/files/desktop-sync
index 4967e49..580d43c 100644
--- a/roles/lmn_vm/files/desktop-sync
+++ b/roles/lmn_vm/files/desktop-sync
@@ -5,8 +5,9 @@
 set -eu
 
 source /etc/lmn/vm.conf
-RSYNC_COMMAND=$(rsync -ai --delete --exclude=mimeinfo.cache "${DESKTOPSTARTERDIR}" \
-		      /usr/local/share/applications/ | sed '/ \.\//d')
+RSYNC_COMMAND=$(rsync -ai --delete --exclude=mimeinfo.cache \
+	           --chown=root:root --chmod=F644,D755 "${DESKTOPSTARTERDIR}" \
+		   /usr/local/share/applications/ | sed '/ \.\//d')
 if [[ $? -eq 0 ]] && [[ -n "${RSYNC_COMMAND}" ]]; then
     echo "${RSYNC_COMMAND}"
     update-desktop-database /usr/local/share/applications