diff --git a/cli/compose/convert/service.go b/cli/compose/convert/service.go
index ef6a04ebcf..93b910967e 100644
--- a/cli/compose/convert/service.go
+++ b/cli/compose/convert/service.go
@@ -217,19 +217,27 @@ func convertServiceSecrets(
 		if gid == "" {
 			gid = "0"
 		}
+		mode := secret.Mode
+		if mode == nil {
+			mode = uint32Ptr(0444)
+		}
 
 		opts = append(opts, &types.SecretRequestOption{
 			Source: source,
 			Target: target,
 			UID:    uid,
 			GID:    gid,
-			Mode:   os.FileMode(secret.Mode),
+			Mode:   os.FileMode(*mode),
 		})
 	}
 
 	return servicecli.ParseSecrets(client, opts)
 }
 
+func uint32Ptr(value uint32) *uint32 {
+	return &value
+}
+
 func convertExtraHosts(extraHosts map[string]string) []string {
 	hosts := []string{}
 	for host, ip := range extraHosts {
diff --git a/cli/compose/types/types.go b/cli/compose/types/types.go
index c74014fb14..058c4d09b8 100644
--- a/cli/compose/types/types.go
+++ b/cli/compose/types/types.go
@@ -229,7 +229,7 @@ type ServiceSecretConfig struct {
 	Target string
 	UID    string
 	GID    string
-	Mode   uint32
+	Mode   *uint32
 }
 
 // UlimitsConfig the ulimit configuration