diff --git a/nixos-config/default.nix b/nixos-config/default.nix
index 26538f5d..6cc3f712 100644
--- a/nixos-config/default.nix
+++ b/nixos-config/default.nix
@@ -198,6 +198,8 @@
 
   security.sudo-rs.enable = true;
 
+  fileSystems."/boot".options = ["umask=0077"];
+
   fonts = {
     enableDefaultPackages = true;