diff --git a/omnibus/config/software/datadog-agent.rb b/omnibus/config/software/datadog-agent.rb
index 580f777528959a..3274b03d3b0bb1 100644
--- a/omnibus/config/software/datadog-agent.rb
+++ b/omnibus/config/software/datadog-agent.rb
@@ -200,7 +200,9 @@
 
   # Secrets backend
   command "inv agent.get-datadog-secret-backend", :env => env
-  command "chmod 500 bin/datadog-secret-backend/datadog-secret-backend"
+  unless windows_target?
+    command "chmod 700 bin/datadog-secret-backend/datadog-secret-backend"
+  end
   copy 'bin/datadog-secret-backend/datadog-secret-backend', "#{install_dir}/embedded/bin"
 
   if osx_target?
diff --git a/pkg/config/setup/config.go b/pkg/config/setup/config.go
index 3544b3753e331e..5a12936ec06b5c 100644
--- a/pkg/config/setup/config.go
+++ b/pkg/config/setup/config.go
@@ -339,7 +339,7 @@ func InitConfig(config pkgconfigmodel.Setup) {
 	config.BindEnvAndSetDefault("enabled_rfc1123_compliant_cluster_name_tag", true)
 
 	// secrets backend
-	config.BindEnvAndSetDefault("secret_backend_command", "")
+	config.BindEnvAndSetDefault("secret_backend_command", filepath.Join(InstallPath, "embedded/bin/datadog-secret-backend"))
 	config.BindEnvAndSetDefault("secret_backend_arguments", []string{})
 	config.BindEnvAndSetDefault("secret_backend_output_max_size", 0)
 	config.BindEnvAndSetDefault("secret_backend_timeout", 0)