diff --git a/src/modules/users/users.conf b/src/modules/users/users.conf
index 240489543..201ff8349 100644
--- a/src/modules/users/users.conf
+++ b/src/modules/users/users.conf
@@ -218,11 +218,11 @@ allowWeakPasswordsDefault: false
 #   this set of permissions. Write the permissions in octal. If not set,
 #   there is no default and no permission-setting is done (uses defaults of
 #   `useradd` in the target). A umask is computed from these permissions
-#   and passed to `useradd`.
+#   and passed to `useradd`. Take care to quote the numeric value.
 user:
   shell: /bin/bash
   forbidden_names: [ root ]
-  home_permissions: 0700
+  home_permissions: "0700"
 
 
 # Hostname settings