diff --git a/confluent_osdeploy/el8/profiles/default/scripts/prechroot.sh b/confluent_osdeploy/el8/profiles/default/scripts/prechroot.sh
index e4a319cb..712eb46f 100644
--- a/confluent_osdeploy/el8/profiles/default/scripts/prechroot.sh
+++ b/confluent_osdeploy/el8/profiles/default/scripts/prechroot.sh
@@ -10,6 +10,7 @@
 nodename=$(grep ^NODENAME /etc/confluent.info|awk '{print $2}')
 export mgr profile nodename
 cp -a /etc/confluent /mnt/sysimage/etc
+chmod -R og-rwx /mnt/sysimage/etc/confluent
 cp /tmp/functions /mnt/sysimage/etc/confluent/
 . /tmp/functions
 cp /tmp/cryptboot /mnt/sysimage/tmp/