diff --git a/CHANGELOG.md b/CHANGELOG.md
index cd19991e..f2c61bac 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -65,6 +65,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Return non-zero exit code on power sub-commands #1439
 - Fix issue that pattern matching broken on `node set` #964
 - Fix issue that domain globs not supported during wwctl node delete. #1449
+- Fix overlay permissions in /root/ and /root/.ssh/. #1452
 
 ## v4.5.8, 2024-10-01
 
diff --git a/warewulf.spec.in b/warewulf.spec.in
index aa1e3bb3..d553f839 100644
--- a/warewulf.spec.in
+++ b/warewulf.spec.in
@@ -212,6 +212,8 @@ getent group %{wwgroup} >/dev/null || groupadd -r %{wwgroup}
 %dir %{_sharedstatedir}/warewulf/overlays/wwinit
 %dir %{_sharedstatedir}/warewulf/overlays/wwclient
 %attr(-, root, root) %{_sharedstatedir}/warewulf/overlays/*/rootfs
+%attr(700, root, root) %{_sharedstatedir}/warewulf/overlays/generic/rootfs/root
+%attr(700, root, root) %{_sharedstatedir}/warewulf/overlays/generic/rootfs/root/.ssh
 
 %attr(-, root, root) %{_bindir}/wwctl
 %attr(-, root, root) %{_prefix}/lib/firewalld/services/warewulf.xml