diff --git a/nix/module.nix b/nix/module.nix
index 6834c6279..93d4761c8 100644
--- a/nix/module.nix
+++ b/nix/module.nix
@@ -396,8 +396,8 @@ in
       script = ''
         ${concatStringsSep "\n" (mapAttrsToList (n: v: ''export ${n}="$(cat '${v}')"'') envSecrets)}
         exec ${bookwyrm}/bin/gunicorn bookwyrm.wsgi:application \
-          ${concatStringsSep " " (map (elem: "--bind ${elem}") cfg.bindTo)}
-          --umask 0660
+          ${concatStringsSep " " (map (elem: "--bind ${elem}") cfg.bindTo)} \
+          --umask 0007
       '';
     };