diff --git a/iso/installer.py b/iso/installer.py
index 65c67ec..3388535 100644
--- a/iso/installer.py
+++ b/iso/installer.py
@@ -948,6 +948,7 @@ class InstallerWindow(Adw.ApplicationWindow):
         if proc.returncode != 0:
             raise RuntimeError(f"Failed to write role-state.nix: {proc.stderr}")
         run(["sudo", "cp", "/mnt/etc/nixos/custom.template.nix", "/mnt/etc/nixos/custom.nix"])
+        run(["sudo", "chmod", "644", "/mnt/etc/nixos/custom.nix"])
 
     # ── Step 4: Ready to install ──────────────────────────────────────────
 
diff --git a/iso/sovran-install-headless.sh b/iso/sovran-install-headless.sh
index bf9fc35..b5d4840 100755
--- a/iso/sovran-install-headless.sh
+++ b/iso/sovran-install-headless.sh
@@ -245,6 +245,7 @@ if [[ -n "$DEPLOY_KEY" || -n "$HEADSCALE_SERVER" ]]; then
     } > /mnt/etc/nixos/custom.nix
 else
     cp /mnt/etc/nixos/custom.template.nix /mnt/etc/nixos/custom.nix
+    chmod 644 /mnt/etc/nixos/custom.nix
 fi
 
 # ── Write Headscale auth key if provided ─────────────────────────────────────