diff --git a/roles/archbuild/tasks/main.yml b/roles/archbuild/tasks/main.yml
index a083b68c425b3353bf663bd1a79da42138027a19..f573d450627f93ef8c13cdc809548b3c581d88dd 100644
--- a/roles/archbuild/tasks/main.yml
+++ b/roles/archbuild/tasks/main.yml
@@ -79,7 +79,7 @@
     path: '/var/lib/{{ "/".join(item) }}'
     owner: root
     group: root
-    mode: 0777
+    mode: '0777'
   with_nested:
     - [archbuilddest]
     - [srcdest]
diff --git a/roles/archive/tasks/main.yml b/roles/archive/tasks/main.yml
index 5e0664c58c4d31024ec5dc922906dcf27b6503eb..0f9ac67a9c804e4a296a722282b29b606b631606 100644
--- a/roles/archive/tasks/main.yml
+++ b/roles/archive/tasks/main.yml
@@ -7,7 +7,7 @@
     state: directory
     owner: archive
     group: archive
-    mode: 0755
+    mode: '0755'
 
 - name: Setup archive configuration
   template:
@@ -15,7 +15,7 @@
     dest: /etc/archive.conf
     owner: root
     group: root
-    mode: 0644
+    mode: '0644'
 
 - name: Setup archive timer
   systemd: name=archive.timer enabled=yes state=started
diff --git a/roles/archive_web/tasks/main.yml b/roles/archive_web/tasks/main.yml
index d2447e194899396928595fbddf2e0454ff4bc3a4..5ac4916c75a074c9a9bb068974fba56a3765dc64 100644
--- a/roles/archive_web/tasks/main.yml
+++ b/roles/archive_web/tasks/main.yml
@@ -10,7 +10,7 @@
     dest: /etc/nginx/nginx.d/archive.conf
     owner: root
     group: root
-    mode: 0644
+    mode: '0644'
   notify:
     - Reload nginx
   tags: ['nginx']
@@ -21,4 +21,4 @@
     state: directory
     owner: root
     group: root
-    mode: 0755
+    mode: '0755'
diff --git a/roles/aurweb/tasks/main.yml b/roles/aurweb/tasks/main.yml
index e12525c155ceda58fa9056c5fa47dbf805151e99..7a6ded55abc00c2c68c2e83bf7bf5362af3f8368 100644
--- a/roles/aurweb/tasks/main.yml
+++ b/roles/aurweb/tasks/main.yml
@@ -263,7 +263,7 @@
     state: touch
     owner: "{{ aurweb_user }}"
     group: http
-    mode: 0644
+    mode: '0644'
   when: git.changed
 
 - name: Create git repo dir
diff --git a/roles/borg_server/tasks/main.yml b/roles/borg_server/tasks/main.yml
index 889bac2c24df143d05becc294c490acab0614b69..7c9264a588a64d247bb79dba3ab352ddcc924e53 100644
--- a/roles/borg_server/tasks/main.yml
+++ b/roles/borg_server/tasks/main.yml
@@ -12,7 +12,7 @@
     state: directory
     owner: borg
     group: borg
-    mode: 0700
+    mode: '0700'
 
 - name: Create the root backup directory at {{ backup_dir }}
   file:
@@ -20,7 +20,7 @@
     state: directory
     owner: borg
     group: borg
-    mode: 0700
+    mode: '0700'
   with_items: "{{ backup_clients }}"
 
 - name: Fetch ssh keys from each borg client machine
diff --git a/roles/fail2ban/tasks/main.yml b/roles/fail2ban/tasks/main.yml
index 19418fea552860c9d3d48d0de264d2ae1a12e147..dc06420299fb31c7fbcede98ffa578118d028fa8 100644
--- a/roles/fail2ban/tasks/main.yml
+++ b/roles/fail2ban/tasks/main.yml
@@ -11,7 +11,7 @@
     state: "directory"
     owner: "root"
     group: "root"
-    mode: 0755
+    mode: '0755'
 
 - name: Install systemd unit override file
   template:
@@ -19,7 +19,7 @@
     dest: "/etc/systemd/system/fail2ban.service.d/override.conf"
     owner: "root"
     group: "root"
-    mode: 0644
+    mode: '0644'
 
 - name: Install local config files
   template:
@@ -27,7 +27,7 @@
     dest: "/etc/fail2ban/{{ item }}"
     owner: "root"
     group: "root"
-    mode: 0644
+    mode: '0644'
   with_items:
     - "fail2ban.local"
     - "jail.local"
@@ -40,7 +40,7 @@
     dest: "/etc/fail2ban/action.d/firewallcmd-allports.local"
     owner: "root"
     group: "root"
-    mode: 0644
+    mode: '0644'
   notify:
     - Restart fail2ban
 
@@ -51,7 +51,7 @@
     dest: "/etc/fail2ban/jail.d/sshd.local"
     owner: "root"
     group: "root"
-    mode: 0644
+    mode: '0644'
   notify:
     - Reload fail2ban jails
 
@@ -62,7 +62,7 @@
     dest: "/etc/fail2ban/jail.d/postfix.local"
     owner: "root"
     group: "root"
-    mode: 0644
+    mode: '0644'
   notify:
     - Reload fail2ban jails
 
@@ -73,7 +73,7 @@
     dest: "/etc/fail2ban/jail.d/dovecot.local"
     owner: "root"
     group: "root"
-    mode: 0644
+    mode: '0644'
   notify:
     - Reload fail2ban jails
 
@@ -84,7 +84,7 @@
     dest: "/etc/fail2ban/jail.d/nginx-limit-req.local"
     owner: "root"
     group: "root"
-    mode: 0644
+    mode: '0644'
   notify:
     - Reload fail2ban jails
 
diff --git a/roles/hetzner_storagebox/tasks/main.yml b/roles/hetzner_storagebox/tasks/main.yml
index c06aa78799286dcae82064e8f23fb51ae86fe123..1c1eb507bd0c8c00aceaaf5841d2664a9556f292 100644
--- a/roles/hetzner_storagebox/tasks/main.yml
+++ b/roles/hetzner_storagebox/tasks/main.yml
@@ -99,7 +99,7 @@
   blockinfile:
     path: /root/.ssh/config
     create: true
-    mode: 0600
+    mode: '0600'
     block: |
       Host {{ storagebox_hostname }}
         User {{ backup_client_usernames[item] }}
diff --git a/roles/install_arch/tasks/main.yml b/roles/install_arch/tasks/main.yml
index 71e549f19e62acfb9e0c2af0b62549df70feba20..0512d00c2a069fc1b6a26febdc2c23ea79320a72 100644
--- a/roles/install_arch/tasks/main.yml
+++ b/roles/install_arch/tasks/main.yml
@@ -57,7 +57,7 @@
   get_url:
     url: "{{ item }}"
     dest: /tmp/
-    mode: 0644
+    mode: '0644'
   loop:
     - https://geo.mirror.pkgbuild.com/iso/{{ bootstrap_version }}/archlinux-bootstrap-x86_64.tar.gz
     - https://archlinux.org/iso/{{ bootstrap_version }}/archlinux-bootstrap-x86_64.tar.gz.sig
@@ -151,7 +151,7 @@
     path: /mnt/etc/default/grub
     owner: root
     group: root
-    mode: 0644
+    mode: '0644'
     regexp: "^GRUB_CMDLINE_LINUX_DEFAULT="
     line: "GRUB_CMDLINE_LINUX_DEFAULT=\"rootflags=compress-force=zstd\""
   when: filesystem == "btrfs"
diff --git a/roles/keycloak/tasks/main.yml b/roles/keycloak/tasks/main.yml
index bfdd8dc3f0b8b764630bb94df8e13dcc05a3d2f7..0265cfc2c5ab55b0092716a41b1488a0380af921 100644
--- a/roles/keycloak/tasks/main.yml
+++ b/roles/keycloak/tasks/main.yml
@@ -57,7 +57,7 @@
     password: "{{ vault_keycloak_nginx_passwd }}"
     owner: root
     group: http
-    mode: 0640
+    mode: '0640'
 
 - name: Create ssl cert
   include_role:
diff --git a/roles/maintenance/tasks/main.yml b/roles/maintenance/tasks/main.yml
index 0dd1bd4aaf72eb925b5d78f27afc9b9aed12bfa3..b1e4e73d9d60f85e8916fd4131851ae9bc392570 100644
--- a/roles/maintenance/tasks/main.yml
+++ b/roles/maintenance/tasks/main.yml
@@ -14,7 +14,7 @@
     dest: "{{ service_nginx_conf }}"
     owner: root
     group: root
-    mode: 0644
+    mode: '0644'
   notify: Reload nginx
   when: service_nginx_template is not defined and maintenance is defined and maintenance | bool
 
@@ -24,7 +24,7 @@
     dest: "{{ service_nginx_conf }}"
     owner: root
     group: root
-    mode: 0644
+    mode: '0644'
   notify: Reload nginx
   when: service_nginx_template is defined and maintenance is defined and maintenance | bool
 
@@ -34,7 +34,7 @@
     dest: "{{ maintenance_http_dir }}/{{ service_domain }}/503.html"
     owner: root
     group: root
-    mode: 0644
+    mode: '0644'
   when: maintenance is defined and maintenance | bool
 
 - name: Force reload nginx
diff --git a/roles/matrix/tasks/main.yml b/roles/matrix/tasks/main.yml
index b9f19644ed1dc2fe5f762b75bc61d0d1e119d4d0..e7d1d076ef847b24d797916961fd2e4dcaa3e0e0 100644
--- a/roles/matrix/tasks/main.yml
+++ b/roles/matrix/tasks/main.yml
@@ -238,7 +238,7 @@
     dest: /etc/synapse/{{ matrix_server_name }}.signing.key
     owner: root
     group: synapse
-    mode: 0640
+    mode: '0640'
 
 - name: Install ircpass key  # noqa template-instead-of-copy
   copy:
@@ -246,7 +246,7 @@
     dest: /etc/synapse/{{ matrix_server_name }}.ircpass.key
     owner: root
     group: synapse
-    mode: 0640
+    mode: '0640'
 
 - name: Make nginx log dir
   file: path=/var/log/nginx/{{ matrix_domain }} state=directory owner=root group=root mode=0755
diff --git a/roles/postgres/tasks/main.yml b/roles/postgres/tasks/main.yml
index c46fa866095aba40ff6a7ba15a216e2a6d9cbdeb..81dde9e8aae81dcbb5a1cdd065ce65b6c5a2be86 100644
--- a/roles/postgres/tasks/main.yml
+++ b/roles/postgres/tasks/main.yml
@@ -14,7 +14,7 @@
     group: postgres
     attributes: "+C"
     path: /var/lib/postgres/data
-    mode: 0700
+    mode: '0700'
   when: filesystem == "btrfs"
 
 - name: Initialize postgres
diff --git a/roles/sudo/tasks/main.yml b/roles/sudo/tasks/main.yml
index 6063f584bc420947df91503aaafae95de9903ff5..62a921c9b881762051ef4f05a182773a51f7c216 100644
--- a/roles/sudo/tasks/main.yml
+++ b/roles/sudo/tasks/main.yml
@@ -20,7 +20,7 @@
     insertafter: '^# %wheel ALL=\(ALL\) ALL'
     line: '%wheel ALL=(ALL) ALL'
     validate: 'visudo -cf %s'
-    mode: 0440
+    mode: '0440'
     owner: root
     group: root
 
@@ -32,6 +32,6 @@
     insertafter: '^# Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"'
     line: 'Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/bin"'
     validate: 'visudo -cf %s'
-    mode: 0440
+    mode: '0440'
     owner: root
     group: root