You can specify the UID, GID, and mode of the secret from within the container: https://docs.docker.com/engine/reference/commandline/service..., and pass the same configuration to the service update command as well.
$ echo "my secret" | dd bs=512 conv=sync | docker secret create my_secret_data -