diff --git a/nixos/modules/security/setuid-wrappers.nix b/nixos/modules/security/setuid-wrappers.nix
index 62df85816e50..78be1cc6cdee 100644
--- a/nixos/modules/security/setuid-wrappers.nix
+++ b/nixos/modules/security/setuid-wrappers.nix
@@ -46,6 +46,7 @@ in
             group = "postdrop";
             setuid = false;
             setgid = true;
+            permissions = "u+rx,g+x,o+x";
           }
         ];
       description = ''