diff --git a/INSTALLATION.md b/INSTALLATION.md
index a8f132d..56d205c 100644
--- a/INSTALLATION.md
+++ b/INSTALLATION.md
@@ -75,7 +75,7 @@ fileSystems."/" =
 fileSystems."/boot" =
   { device = "/dev/disk/by-label/nixboot";
     fsType = "vfat";
-    options = [ "fmask=0022" "dmask=0022" ];
+    options = [ "fmask=0077" "dmask=0077" ];  # only root may read /boot
   };
 fileSystems."/home" =
   { device = "/dev/disk/by-label/nixhome";
diff --git a/hosts/argon/hardware-configuration.nix b/hosts/argon/hardware-configuration.nix
index 69686bf..4518826 100644
--- a/hosts/argon/hardware-configuration.nix
+++ b/hosts/argon/hardware-configuration.nix
@@ -39,8 +39,8 @@
     device = "/dev/disk/by-label/nixboot";
     fsType = "vfat";
     options = [
-      "fmask=0022"
-      "dmask=0022"
+      "fmask=0077"
+      "dmask=0077"
     ];
   };
 
diff --git a/hosts/krypton/hardware-configuration.nix b/hosts/krypton/hardware-configuration.nix
index 10b7825..c0cbae7 100644
--- a/hosts/krypton/hardware-configuration.nix
+++ b/hosts/krypton/hardware-configuration.nix
@@ -40,8 +40,8 @@
     device = "/dev/disk/by-label/nixboot";
     fsType = "vfat";
     options = [
-      "fmask=0022"
-      "dmask=0022"
+      "fmask=0077"
+      "dmask=0077"
     ];
   };
 
diff --git a/hosts/neon/hardware-configuration.nix b/hosts/neon/hardware-configuration.nix
index e115731..6986b76 100644
--- a/hosts/neon/hardware-configuration.nix
+++ b/hosts/neon/hardware-configuration.nix
@@ -43,8 +43,8 @@
     device = "/dev/disk/by-label/nixboot";
     fsType = "vfat";
     options = [
-      "fmask=0022"
-      "dmask=0022"
+      "fmask=0077"
+      "dmask=0077"
     ];
   };