diff --git a/config/store/location.go b/config/store/location.go
index e073a0c8..e86e3465 100644
--- a/config/store/location.go
+++ b/config/store/location.go
@@ -47,7 +47,7 @@ func Location(filepath string) string {
 		configfile = "./config/config.js"
 	}
 
-	os.MkdirAll(path.Dir(configfile), 0740)
+	os.MkdirAll(path.Dir(configfile), 0755)
 
 	return configfile
 }
diff --git a/config/value/os.go b/config/value/os.go
index 6f57c1b3..337ca7d4 100644
--- a/config/value/os.go
+++ b/config/value/os.go
@@ -42,7 +42,7 @@ func (u *MustDir) Validate() error {
 		return fmt.Errorf("path name must not be empty")
 	}
 
-	if err := u.fs.MkdirAll(val, 0750); err != nil {
+	if err := u.fs.MkdirAll(val, 0755); err != nil {
 		return fmt.Errorf("%s can't be created (%w)", val, err)
 	}
 
diff --git a/http/handler/api/filesystems_test.go b/http/handler/api/filesystems_test.go
index be37b2fb..ad37f3de 100644
--- a/http/handler/api/filesystems_test.go
+++ b/http/handler/api/filesystems_test.go
@@ -519,7 +519,7 @@ func TestFilesystemsPurgeCache(t *testing.T) {
 	memfs, err := fs.NewMemFilesystem(fs.MemConfig{})
 	require.NoError(t, err)
 
-	memfs.MkdirAll("/path", 0744)
+	memfs.MkdirAll("/path", 0755)
 
 	cache, err := cache.NewLRUCache(cache.LRUConfig{
 		TTL: 5 * time.Minute,
diff --git a/io/fs/disk.go b/io/fs/disk.go
index ee6b3ff4..d4f11cc0 100644
--- a/io/fs/disk.go
+++ b/io/fs/disk.go
@@ -196,7 +196,7 @@ func NewRootedDiskFilesystem(config RootedDiskConfig) (Filesystem, error) {
 		fs.root = root
 	}
 
-	err := os.MkdirAll(fs.root, 0700)
+	err := os.MkdirAll(fs.root, 0755)
 	if err != nil {
 		return nil, err
 	}
diff --git a/io/fs/fs_test.go b/io/fs/fs_test.go
index 48820429..c290a804 100644
--- a/io/fs/fs_test.go
+++ b/io/fs/fs_test.go
@@ -16,7 +16,7 @@ import (
 var ErrNoMinio = errors.New("minio binary not found")
 
 func startMinio(t *testing.T, path string) (*exec.Cmd, error) {
-	err := os.MkdirAll(path, 0700)
+	err := os.MkdirAll(path, 0755)
 	require.NoError(t, err)
 
 	minio, err := exec.LookPath("minio")
@@ -255,7 +255,7 @@ func testFiles(t *testing.T, fs Filesystem) {
 
 	require.Equal(t, int64(1), fs.Files())
 
-	fs.MkdirAll("/path/to/foo", 0777)
+	fs.MkdirAll("/path/to/foo", 0755)
 
 	require.Equal(t, int64(1), fs.Files())
 
diff --git a/io/fs/readonly_test.go b/io/fs/readonly_test.go
index ffcf8727..3b3b3dfb 100644
--- a/io/fs/readonly_test.go
+++ b/io/fs/readonly_test.go
@@ -26,7 +26,7 @@ func TestReadOnly(t *testing.T) {
 	_, _, err = ro.WriteFileSafe("/readonly.go", []byte("foobar"))
 	require.Error(t, err)
 
-	err = ro.MkdirAll("/foobar/baz", 0700)
+	err = ro.MkdirAll("/foobar/baz", 0755)
 	require.Error(t, err)
 
 	res := ro.Remove("/readonly.go")
diff --git a/restream/restream.go b/restream/restream.go
index 71191e0a..c30eb73e 100644
--- a/restream/restream.go
+++ b/restream/restream.go
@@ -903,7 +903,7 @@ func validateConfig(config *app.Config, fss []rfs.Filesystem, ffmpeg ffmpeg.FFmp
 				}
 
 				dir := filepath.Dir(strings.TrimPrefix(io.Address, "file:"+basedir))
-				fs.MkdirAll(dir, 0744)
+				fs.MkdirAll(dir, 0755)
 			}
 		}