diff --git a/CHANGELOG.md b/CHANGELOG.md
index ed97ee0b..115f9456 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -65,6 +65,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 - Interleave tmpfs across all available NUMA nodes. #1347, #1348
 - Syncuser watches for changes in mtime rather than ctime. #1358
+- Change the default permissions for provisioned overlay images to `0750` (dirs) and `0660` (files). #1388
 
 ### Fixed
 
diff --git a/internal/app/wwctl/overlay/build/main.go b/internal/app/wwctl/overlay/build/main.go
index c44b30ef..3f155350 100644
--- a/internal/app/wwctl/overlay/build/main.go
+++ b/internal/app/wwctl/overlay/build/main.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"strings"
+	"syscall"
 
 	"github.com/spf13/cobra"
 	warewulfconf "github.com/warewulf/warewulf/internal/pkg/config"
@@ -83,6 +84,9 @@ func CobraRunE(cmd *cobra.Command, args []string) error {
 	}
 
 	if BuildNodes || (!BuildHost && !BuildNodes) {
+		oldMask := syscall.Umask(007)
+		defer syscall.Umask(oldMask)
+
 		if len(OverlayNames) > 0 {
 			err = overlay.BuildSpecificOverlays(nodes, OverlayNames)
 		} else {
diff --git a/internal/pkg/overlay/overlay.go b/internal/pkg/overlay/overlay.go
index 138b034e..0b4322fa 100644
--- a/internal/pkg/overlay/overlay.go
+++ b/internal/pkg/overlay/overlay.go
@@ -136,7 +136,7 @@ func BuildOverlay(nodeInfo node.NodeInfo, context string, overlayNames []string)
 	overlayImage := OverlayImage(nodeInfo.Id.Get(), context, overlayNames)
 	overlayImageDir := path.Dir(overlayImage)
 
-	err := os.MkdirAll(overlayImageDir, 0755)
+	err := os.MkdirAll(overlayImageDir, 0750)
 	if err != nil {
 		return errors.Wrapf(err, "Failed to create directory for %s: %s", name, overlayImageDir)
 	}