diff --git a/root/etc/services.d/beets/run b/root/etc/services.d/beets/run
index dc66f3e..28bb1ab 100644
--- a/root/etc/services.d/beets/run
+++ b/root/etc/services.d/beets/run
@@ -1,5 +1,5 @@
 #!/usr/bin/with-contenv bash
-umask 002
+umask 022
 
 exec \
 	s6-setuidgid abc beet web