diff --git a/tools/utils/atomic-write.go b/tools/utils/atomic-write.go
index 41f83896d..17fb0a7db 100644
--- a/tools/utils/atomic-write.go
+++ b/tools/utils/atomic-write.go
@@ -77,7 +77,7 @@ func AtomicWriteFile(path string, data []byte, perm os.FileMode) (err error) {
 }
 
 func AtomicUpdateFile(path string, data []byte, perms ...fs.FileMode) (err error) {
-	perm := fs.FileMode(0o666)
+	perm := fs.FileMode(0o644)
 	if len(perms) > 0 {
 		perm = perms[0]
 	}