diff --git a/modules/homelab/nginx-proxy.nix b/modules/homelab/nginx-proxy.nix
index ec381d7..ace6bfb 100644
--- a/modules/homelab/nginx-proxy.nix
+++ b/modules/homelab/nginx-proxy.nix
@@ -20,5 +20,7 @@ in
       defaults.email = "me@blakedheld.xyz";
     };
 
+    systemd.services.nginx.serviceConfig = { UMask = lib.mkForce "0007"; };
+
   };
 }