diff --git a/package/systemd/veilid-server.service b/package/systemd/veilid-server.service
index f8d39fae..91556df8 100644
--- a/package/systemd/veilid-server.service
+++ b/package/systemd/veilid-server.service
@@ -15,6 +15,7 @@ TimeoutStopSec=5
 WorkingDirectory=/
 User=veilid
 Group=veilid
+UMask=0002
 
 CapabilityBoundingSet=
 SystemCallFilter=@system-service