diff --git a/depot/containerstore/proxy_config_handler.go b/depot/containerstore/proxy_config_handler.go
index 0b98cd86..fbb54b33 100644
--- a/depot/containerstore/proxy_config_handler.go
+++ b/depot/containerstore/proxy_config_handler.go
@@ -517,7 +517,7 @@ func writeProxyConfig(proxyConfig *envoy_bootstrap.Bootstrap, path string) error
 	if err != nil {
 		return err
 	}
-	return os.WriteFile(path, yamlStr, 0666)
+	return os.WriteFile(path, yamlStr, 0644)
 }
 
 func generateListeners(container executor.Container, requireClientCerts, http2Enabled bool) ([]*envoy_listener.Listener, error) {
@@ -685,7 +685,7 @@ func writeDiscoveryResponseYAML(resourceMsg proto.Message, outPath string) error
 	}
 
 	tmpPath := outPath + ".tmp"
-	if err := os.WriteFile(tmpPath, yamlStr, 0666); err != nil {
+	if err := os.WriteFile(tmpPath, yamlStr, 0644); err != nil {
 		return err
 	}