diff --git a/Makefile b/Makefile
index a5a9835e..c7c42693 100644
--- a/Makefile
+++ b/Makefile
@@ -179,6 +179,7 @@ files: all
 	chmod 755 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/$(WWCLIENTDIR)/wwinit
 	chmod 600 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/etc/ssh/ssh*
 	chmod 644 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/etc/ssh/ssh*.pub.ww
+	chmod 750 $(DESTDIR)$(WWOVERLAYDIR)/host
 	install -m 0755 wwctl $(DESTDIR)$(BINDIR)
 	install -m 0644 include/firewalld/warewulf.xml $(DESTDIR)$(FIREWALLDDIR)
 	install -m 0644 include/systemd/warewulfd.service $(DESTDIR)$(SYSTEMDDIR)
diff --git a/internal/pkg/overlay/overlay.go b/internal/pkg/overlay/overlay.go
index 82eccf6a..663c7d11 100644
--- a/internal/pkg/overlay/overlay.go
+++ b/internal/pkg/overlay/overlay.go
@@ -92,6 +92,14 @@ func BuildHostOverlay() error {
 	wwlog.Printf(wwlog.INFO, "Building overlay for %s: host\n", hostname)
 	idEntry.Set(hostname)
 	host.Id = idEntry
+	hostdir := OverlaySourceDir("host")
+	stats, err := os.Stat(hostdir)
+	if err != nil {
+		return errors.Wrap(err, "could not build host overlay ")
+	}
+	if !(stats.Mode() == os.FileMode(0750|os.ModeDir) || stats.Mode() == os.FileMode(0700|os.ModeDir)) {
+		wwlog.Printf(wwlog.WARN, "Permissions of host overlay dir %s are %s (750 is considered as secure)\n", hostdir, stats.Mode())
+	}
 	return BuildOverlayIndir(host, []string{"host"}, "/")
 }