diff --git a/modules/default.nix b/modules/default.nix
index 8630bac..b316c70 100644
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -156,6 +156,7 @@ in
             EXPERIMENTAL_STORE_COMPOSITION = settingsFormat.generate "Config.toml" cache.nar-bridge-composition;
           };
           serviceConfig = {
+            UMask = "007";
             ExecStart = "${pkgs.tvix}/bin/nar-bridge --otlp=false --listen-address=\"${cache.narBridgeListenAddress}\"";
             DynamicUser = true;
             Group = "tvix-castore";