diff --git a/src/backend/buildEngine.test.ts b/src/backend/buildEngine.test.ts
index abb8161..14be5bd 100644
--- a/src/backend/buildEngine.test.ts
+++ b/src/backend/buildEngine.test.ts
@@ -79,7 +79,10 @@ test("equivalent resolved inputs are byte-identical despite different run IDs",
     assert.equal(first.input.artifactBuildId, second.input.artifactBuildId);
     const engine = new BuildEngine(output);
     const one = engine.build(first.input);
+    assert.equal(fs.statSync(one.outputDirectory).mode & 0o777, 0o750);
+    fs.chmodSync(one.outputDirectory, 0o700);
     const two = engine.build(second.input);
+    assert.equal(fs.statSync(two.outputDirectory).mode & 0o777, 0o750);
     assert.equal(one.artifactChecksum, two.artifactChecksum);
     assert.equal(one.outputDirectory, two.outputDirectory);
     assert.deepEqual(one.generatedFiles, two.generatedFiles);
diff --git a/src/backend/repositoryBuildEngine.ts b/src/backend/repositoryBuildEngine.ts
index ba64329..75aaf4a 100644
--- a/src/backend/repositoryBuildEngine.ts
+++ b/src/backend/repositoryBuildEngine.ts
@@ -228,6 +228,7 @@ export class BuildEngine {
     if (!validationReport.summary.passed) return { success: false, outputDirectory, generatedRoutesCount: 0, artifactChecksum: "", artifactSizeBytes: 0, validationReport, generatedFiles: [] };
     if (fs.existsSync(outputDirectory)) {
       const verified = this.verifyRelease(input.artifactBuildId);
+      fs.chmodSync(outputDirectory, 0o750);
       return { success: true, outputDirectory, generatedRoutesCount: verified.routes.length, artifactChecksum: verified.artifactChecksum, artifactSizeBytes: verified.sizeBytes, validationReport, generatedFiles: verified.files };
     }
     fs.mkdirSync(this.releasesDirectory(), { recursive: true });
@@ -375,6 +376,7 @@ export class BuildEngine {
       const generatedFiles = [...files].sort();
       const artifactSizeBytes = generatedFiles.reduce((sum, relative) => sum + fs.statSync(path.join(temporaryDirectory, ...relative.split("/"))).size, 0);
       fs.renameSync(temporaryDirectory, outputDirectory);
+      fs.chmodSync(outputDirectory, 0o750);
       return { success: true, outputDirectory, generatedRoutesCount: routes.size, artifactChecksum, artifactSizeBytes, validationReport, generatedFiles };
     } catch (error) {
       fs.rmSync(temporaryDirectory, { recursive: true, force: true });