diff --git a/CHANGELOG.md b/CHANGELOG.md
index c5245f88..688036a5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - The correct header is now displayed when `-al` flags are specified to overlay
   list.
+- Restrict access to `/warewulf/config` to root only. (#728, #742)
 
 ### Changed
 
diff --git a/Makefile b/Makefile
index 2772c723..61e470bc 100644
--- a/Makefile
+++ b/Makefile
@@ -188,7 +188,7 @@ files: all
 	chmod 600 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/etc/ssh/ssh*
 	chmod 600 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/etc/NetworkManager/system-connections/ww4-managed.ww
 	chmod 644 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/etc/ssh/ssh*.pub.ww
-	chmod 644 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/warewulf/config.ww
+	chmod 600 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/warewulf/config.ww
 	chmod 750 $(DESTDIR)$(WWOVERLAYDIR)/host
 	install -m 0755 wwctl $(DESTDIR)$(BINDIR)
 	install -m 0755 wwapic $(DESTDIR)$(BINDIR)