diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go
index f6a96b6..a5a1a36 100644
--- a/pkg/config/config_test.go
+++ b/pkg/config/config_test.go
@@ -17,16 +17,17 @@ package config_test
 
 import (
 	"fmt"
-	"github.com/kairos-io/kairos-agent/v2/pkg/constants"
-	v1 "github.com/kairos-io/kairos-agent/v2/pkg/types/v1"
-	"github.com/kairos-io/kairos-agent/v2/pkg/utils/fs"
-	v1mocks "github.com/kairos-io/kairos-agent/v2/tests/mocks"
-	"github.com/twpayne/go-vfs"
-	"github.com/twpayne/go-vfs/vfst"
 	"path/filepath"
 	"reflect"
 	"strings"
 
+	"github.com/kairos-io/kairos-agent/v2/pkg/constants"
+	v1 "github.com/kairos-io/kairos-agent/v2/pkg/types/v1"
+	fsutils "github.com/kairos-io/kairos-agent/v2/pkg/utils/fs"
+	v1mocks "github.com/kairos-io/kairos-agent/v2/tests/mocks"
+	"github.com/twpayne/go-vfs"
+	"github.com/twpayne/go-vfs/vfst"
+
 	. "github.com/kairos-io/kairos-agent/v2/pkg/config"
 	. "github.com/kairos-io/kairos-sdk/schema"
 	. "github.com/onsi/ginkgo/v2"
@@ -173,6 +174,12 @@ var _ = Describe("Schema", func() {
 			Expect(err).ShouldNot(HaveOccurred())
 			loadedInstallState, err := config.LoadInstallState()
 			Expect(err).ShouldNot(HaveOccurred())
+			stat, err := fs.Stat(statePath)
+			Expect(err).To(BeNil())
+			Expect(int(stat.Mode().Perm())).To(Equal(constants.ConfigPerm))
+			stat, err = fs.Stat(recoveryPath)
+			Expect(err).To(BeNil())
+			Expect(int(stat.Mode().Perm())).To(Equal(constants.ConfigPerm))
 
 			Expect(*loadedInstallState).To(Equal(*installState))
 		})
diff --git a/pkg/elemental/elemental_test.go b/pkg/elemental/elemental_test.go
index 474365e..5406af6 100644
--- a/pkg/elemental/elemental_test.go
+++ b/pkg/elemental/elemental_test.go
@@ -869,9 +869,14 @@ var _ = Describe("Elemental", Label("elemental"), func() {
 
 			err = e.CopyCloudConfig(cloudInit)
 			Expect(err).To(BeNil())
-			copiedFile, err := fs.ReadFile(fmt.Sprintf("%s/90_custom.yaml", cnst.OEMDir))
+			configFilePath := fmt.Sprintf("%s/90_custom.yaml", cnst.OEMDir)
+			copiedFile, err := fs.ReadFile(configFilePath)
 			Expect(err).To(BeNil())
 			Expect(copiedFile).To(ContainSubstring(testString))
+			stat, err := fs.Stat(configFilePath)
+			Expect(err).To(BeNil())
+			Expect(int(stat.Mode().Perm())).To(Equal(cnst.ConfigPerm))
+
 		})
 		It("Doesnt do anything if the config file is not set", func() {
 			err := e.CopyCloudConfig([]string{})