diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index cbbf26db80..3d9b744e11 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -89,6 +89,16 @@ Updates of upstream application versions
   which needs to be synchronized with the Elasticsearch configuration via
   Ansible inventory (Kibana can be installed separately from Elasticsearch).
 
+Fixed
+~~~~~
+
+:ref:`debops.gitlab` role
+'''''''''''''''''''''''''
+
+- Fixed an issue with the :file:`/etc/gitlab/ssl/` directory changing its mode
+  from 0775 set by the role to 0755 set by the :command:`gitlab-ctl
+  reconfigure` command, making the role not idempotent.
+
 Removed
 ~~~~~~~
 
diff --git a/ansible/roles/gitlab/tasks/main.yml b/ansible/roles/gitlab/tasks/main.yml
index ecd71ceafc..4c547cb232 100644
--- a/ansible/roles/gitlab/tasks/main.yml
+++ b/ansible/roles/gitlab/tasks/main.yml
@@ -52,7 +52,7 @@
     state: 'directory'
     mode: '{{ item.mode }}'
   loop:
-    - { path: '/etc/gitlab/ssl',           mode: '0775' }
+    - { path: '/etc/gitlab/ssl',           mode: '0755' }
     - { path: '/etc/gitlab/trusted-certs', mode: '0755' }
 
 - name: Manage CA certificate symlinks in GitLab environment