diff --git a/cli/compose/convert/service.go b/cli/compose/convert/service.go
index 4a5489562c39fb7661a86e67f832958d89b58a63..882050560e47ee56f9988b78384f4333818e0d6a 100644
--- a/cli/compose/convert/service.go
+++ b/cli/compose/convert/service.go
@@ -219,19 +219,27 @@ func convertServiceSecrets(
 		if gid == "" {
 			gid = "0"
 		}
+		mode := secret.Mode
+		if mode == nil {
+			mode = uint32Ptr(0444)
+		}
 
 		opts = append(opts, &types.SecretRequestOption{
 			Source: source,
 			Target: target,
 			UID:    uid,
 			GID:    gid,
-			Mode:   os.FileMode(secret.Mode),
+			Mode:   os.FileMode(*mode),
 		})
 	}
 
 	return servicecli.ParseSecrets(client, opts)
 }
 
+func uint32Ptr(value uint32) *uint32 {
+	return &value
+}
+
 func convertExtraHosts(extraHosts map[string]string) []string {
 	hosts := []string{}
 	for host, ip := range extraHosts {
diff --git a/cli/compose/types/types.go b/cli/compose/types/types.go
index cae7b4af263b5a5e5c8031c6746cae4f5b128280..d1371d2a1cb8190c4ebf9ab0bf989b7392622d01 100644
--- a/cli/compose/types/types.go
+++ b/cli/compose/types/types.go
@@ -199,7 +199,7 @@ type ServiceSecretConfig struct {
 	Target string
 	UID    string
 	GID    string
-	Mode   uint32
+	Mode   *uint32
 }
 
 // UlimitsConfig the ulimit configuration