diff --git a/nixops/chiron-hardware-configuration.nix b/nixops/chiron-hardware-configuration.nix
index f219ebe..12fd4d0 100644
--- a/nixops/chiron-hardware-configuration.nix
+++ b/nixops/chiron-hardware-configuration.nix
@@ -18,6 +18,7 @@
   fileSystems."/boot" =
     { device = "/dev/disk/by-uuid/060C-8772";
       fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
     };
 
   swapDevices = [ ];
diff --git a/nixops/demeter-hardware-configuration.nix b/nixops/demeter-hardware-configuration.nix
index d4776c8..4187239 100644
--- a/nixops/demeter-hardware-configuration.nix
+++ b/nixops/demeter-hardware-configuration.nix
@@ -21,6 +21,7 @@
   fileSystems."/boot" =
     { device = "/dev/disk/by-uuid/76A2-F01F";
       fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
     };
 
   swapDevices = [ ];
diff --git a/nixops/franz-hardware-configuration.nix b/nixops/franz-hardware-configuration.nix
index 57dd2d7..be326f2 100644
--- a/nixops/franz-hardware-configuration.nix
+++ b/nixops/franz-hardware-configuration.nix
@@ -23,6 +23,7 @@
   fileSystems."/boot" =
     { device = "/dev/disk/by-uuid/A33B-F001";
       fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
     };
 
   swapDevices = [ ];
diff --git a/nixops/hera-hardware-configuration.nix b/nixops/hera-hardware-configuration.nix
index 68f7605..25004b4 100644
--- a/nixops/hera-hardware-configuration.nix
+++ b/nixops/hera-hardware-configuration.nix
@@ -18,6 +18,7 @@
   fileSystems."/boot" =
     { device = "/dev/disk/by-uuid/8C30-F6DC";
       fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
     };
 
   swapDevices = [ ];
diff --git a/nixops/hestia-hardware-configuration.nix b/nixops/hestia-hardware-configuration.nix
index a518af8..fa2b056 100644
--- a/nixops/hestia-hardware-configuration.nix
+++ b/nixops/hestia-hardware-configuration.nix
@@ -18,6 +18,7 @@
   fileSystems."/boot" =
     { device = "/dev/disk/by-uuid/E085-5F21";
       fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
     };
 
   swapDevices = [ ];
diff --git a/nixops/juno-hardware-configuration.nix b/nixops/juno-hardware-configuration.nix
index a575c57..85b833c 100644
--- a/nixops/juno-hardware-configuration.nix
+++ b/nixops/juno-hardware-configuration.nix
@@ -21,6 +21,7 @@
   fileSystems."/boot" =
     { device = "/dev/disk/by-uuid/4E51-B390";
       fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
     };
 
   swapDevices = [ ];
diff --git a/nixops/old-nixbld-hardware-configuration.nix b/nixops/old-nixbld-hardware-configuration.nix
index 25ff917..a0ea1d3 100644
--- a/nixops/old-nixbld-hardware-configuration.nix
+++ b/nixops/old-nixbld-hardware-configuration.nix
@@ -21,6 +21,7 @@
   fileSystems."/boot" =
     { device = "/dev/disk/by-uuid/D0A3-DDAE";
       fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
     };
 
   powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
diff --git a/nixops/vulcan-hardware-configuration.nix b/nixops/vulcan-hardware-configuration.nix
index 5ba361c..7cad311 100644
--- a/nixops/vulcan-hardware-configuration.nix
+++ b/nixops/vulcan-hardware-configuration.nix
@@ -18,6 +18,7 @@
   fileSystems."/boot" =
     { device = "/dev/disk/by-uuid/8F4B-AD84";
       fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
     };
 
   swapDevices = [ ];
diff --git a/nixops/zeus-hardware-configuration.nix b/nixops/zeus-hardware-configuration.nix
index 5337031..a2f5c2f 100644
--- a/nixops/zeus-hardware-configuration.nix
+++ b/nixops/zeus-hardware-configuration.nix
@@ -18,6 +18,7 @@
   fileSystems."/boot" =
     { device = "/dev/disk/by-uuid/91B4-E546";
       fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
     };
 
   swapDevices = [ ];