diff --git a/CHANGELOG.md b/CHANGELOG.md
index 10cc0ab5..9e02eb7b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -64,6 +64,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 - Interleave tmpfs across all available NUMA nodes. #1347, #1348
 - Syncuser watches for changes in mtime rather than ctime. #1358
+- Change the default permissions for provisioned overlay images to `0750` (dirs) and `0660` (files). #1388
 
 ### Fixed
 
diff --git a/internal/pkg/overlay/overlay.go b/internal/pkg/overlay/overlay.go
index 138b034e..0b4322fa 100644
--- a/internal/pkg/overlay/overlay.go
+++ b/internal/pkg/overlay/overlay.go
@@ -136,7 +136,7 @@ func BuildOverlay(nodeInfo node.NodeInfo, context string, overlayNames []string)
 	overlayImage := OverlayImage(nodeInfo.Id.Get(), context, overlayNames)
 	overlayImageDir := path.Dir(overlayImage)
 
-	err := os.MkdirAll(overlayImageDir, 0755)
+	err := os.MkdirAll(overlayImageDir, 0750)
 	if err != nil {
 		return errors.Wrapf(err, "Failed to create directory for %s: %s", name, overlayImageDir)
 	}
diff --git a/internal/pkg/util/util.go b/internal/pkg/util/util.go
index 60266d93..830f5a8a 100644
--- a/internal/pkg/util/util.go
+++ b/internal/pkg/util/util.go
@@ -543,6 +543,9 @@ func CpioCreate(
 
 	args = append(args, cpio_args...)
 
+	oldMask := syscall.Umask(007)
+	defer syscall.Umask(oldMask)
+
 	proc := exec.Command("cpio", args...)
 
 	stdin, err := proc.StdinPipe()