diff --git a/home.admin/_bootstrap.sh b/home.admin/_bootstrap.sh
index fb6ca5a5d..027a0d79b 100755
--- a/home.admin/_bootstrap.sh
+++ b/home.admin/_bootstrap.sh
@@ -30,6 +30,7 @@ setupFile="/var/cache/raspiblitz/temp/raspiblitz.setup"
 # Init boostrap log file
 echo "Writing logs to: ${logFile}"
 echo "" > $logFile
+sudo chmod 640 ${logFile}
 echo "***********************************************" >> $logFile
 echo "Running RaspiBlitz Bootstrap ${codeVersion}" >> $logFile
 date >> $logFile
diff --git a/home.admin/_commands.sh b/home.admin/_commands.sh
index 1f0fc9ce8..f273cf1ff 100755
--- a/home.admin/_commands.sh
+++ b/home.admin/_commands.sh
@@ -116,6 +116,7 @@ function debug() {
   echo "Printing debug logs. Be patient, this should take maximum 2 minutes ..."
   /home/admin/config.scripts/blitz.debug.sh > /var/cache/raspiblitz/debug.log
   /home/admin/config.scripts/blitz.debug.sh redact /var/cache/raspiblitz/debug.log
+  sudo chmod 640 /var/cache/raspiblitz/debug.log
   if [ "$1" = "-l" ]||[ "$1" = "--link" ]; then
     proxy="-X 5 -x localhost:9050"
     if [ "$2" = "-n" ]||[ "$2" = "--no-tor" ]; then proxy=""; fi
diff --git a/home.admin/_provision.migration.sh b/home.admin/_provision.migration.sh
index 0b6ef9e2c..ee8450e62 100755
--- a/home.admin/_provision.migration.sh
+++ b/home.admin/_provision.migration.sh
@@ -18,6 +18,7 @@ source /var/cache/raspiblitz/temp/raspiblitz.setup
 
 # log header
 echo "" > ${logFile}
+sudo chmod 640 ${logFile}
 echo "###################################" >> ${logFile}
 echo "# _provision.migration.sh" >> ${logFile}
 echo "###################################" >> ${logFile}
diff --git a/home.admin/_provision.setup.sh b/home.admin/_provision.setup.sh
index ad9ca28fd..7bdc3d89e 100755
--- a/home.admin/_provision.setup.sh
+++ b/home.admin/_provision.setup.sh
@@ -26,6 +26,7 @@ source ${configFile}
 
 # log header
 echo "" > ${logFile}
+sudo chmod 640 ${logFile}
 echo "###################################" >> ${logFile}
 echo "# _provision.setup.sh" >> ${logFile}
 echo "###################################" >> ${logFile}
diff --git a/home.admin/_provision.update.sh b/home.admin/_provision.update.sh
index 6de22cafd..90226eb9c 100755
--- a/home.admin/_provision.update.sh
+++ b/home.admin/_provision.update.sh
@@ -21,6 +21,7 @@ source ${setupFile}
 
 # log header
 echo "" > ${logFile}
+sudo chmod 640 ${logFile}
 echo "###################################" >> ${logFile}
 echo "# _provision.update.sh" >> ${logFile}
 echo "###################################" >> ${logFile}
diff --git a/home.admin/setup.scripts/controlFinalDialog.sh b/home.admin/setup.scripts/controlFinalDialog.sh
index 1d09b09d4..5f47c0a63 100755
--- a/home.admin/setup.scripts/controlFinalDialog.sh
+++ b/home.admin/setup.scripts/controlFinalDialog.sh
@@ -179,6 +179,7 @@ echo "# final setup reboot ..." >> /home/admin/raspiblitz.log
 # AFTER SETUP REBOOT
 # touchscreen activation, start with configured SWAP, fix LCD text bug
 sudo cp /home/admin/raspiblitz.log /home/admin/raspiblitz.setup.log
+sudo chmod 640 /home/admin/raspiblitz.setup.log
 timeout 120 /home/admin/config.scripts/blitz.shutdown.sh reboot finalsetup
 # if system has not rebooted yet - force reboot directly
 sudo shutdown -r now