diff --git a/src/coreos.osbuild.aarch64.mpp.yaml b/src/coreos.osbuild.aarch64.mpp.yaml
index d2f27568bc..29f7367034 100644
--- a/src/coreos.osbuild.aarch64.mpp.yaml
+++ b/src/coreos.osbuild.aarch64.mpp.yaml
@@ -116,13 +116,13 @@ pipelines:
         options:
           paths:
             - path: /boot/efi
-              mode: 448
+              mode: 493
       # platforms.json will live here
       - type: org.osbuild.mkdir
         options:
           paths:
             - path: /boot/coreos
-              mode: 644
+              mode: 493
       - type: org.osbuild.ignition
       # Deploy via container if we have a container ociarchive, else from repo.
       - mpp-if: ociarchive != ''
diff --git a/src/coreos.osbuild.ppc64le.mpp.yaml b/src/coreos.osbuild.ppc64le.mpp.yaml
index a179a33750..155c516c96 100644
--- a/src/coreos.osbuild.ppc64le.mpp.yaml
+++ b/src/coreos.osbuild.ppc64le.mpp.yaml
@@ -119,7 +119,7 @@ pipelines:
         options:
           paths:
             - path: /boot/coreos
-              mode: 644
+              mode: 493
       - type: org.osbuild.ignition
       # Deploy via container if we have a container ociarchive, else from repo.
       - mpp-if: ociarchive != ''
diff --git a/src/coreos.osbuild.s390x.mpp.yaml b/src/coreos.osbuild.s390x.mpp.yaml
index bda495f0d6..e0f7e9e866 100644
--- a/src/coreos.osbuild.s390x.mpp.yaml
+++ b/src/coreos.osbuild.s390x.mpp.yaml
@@ -106,7 +106,7 @@ pipelines:
         options:
           paths:
             - path: /boot/coreos
-              mode: 644
+              mode: 493
       - type: org.osbuild.ignition
       # Deploy via container if we have a container ociarchive, else from repo.
       - mpp-if: ociarchive != ''
diff --git a/src/coreos.osbuild.x86_64.mpp.yaml b/src/coreos.osbuild.x86_64.mpp.yaml
index 4d366dc5cf..3a3b55cf5d 100644
--- a/src/coreos.osbuild.x86_64.mpp.yaml
+++ b/src/coreos.osbuild.x86_64.mpp.yaml
@@ -118,13 +118,13 @@ pipelines:
         options:
           paths:
             - path: /boot/efi
-              mode: 448
+              mode: 493
       # platforms.json will live here
       - type: org.osbuild.mkdir
         options:
           paths:
             - path: /boot/coreos
-              mode: 644
+              mode: 493
       - type: org.osbuild.ignition
       # Deploy via container if we have a container ociarchive, else from repo.
       - mpp-if: ociarchive != ''