diff --git a/distribution/build.gradle b/distribution/build.gradle
index c1ec1fdd40b4d..d6495de1490fb 100644
--- a/distribution/build.gradle
+++ b/distribution/build.gradle
@@ -245,6 +245,8 @@ configure(subprojects.findAll { ['archives', 'packages'].contains(it.name) }) {
           if (it.relativePath.segments[-2] == 'bin') {
             // bin files, wherever they are within modules (eg platform specific) should be executable
             it.mode = 0755
+          } else {
+            it.mode = 0644
           }
         }
         if (oss) {
diff --git a/distribution/packages/build.gradle b/distribution/packages/build.gradle
index 863f6a3613d73..384a723ed3e91 100644
--- a/distribution/packages/build.gradle
+++ b/distribution/packages/build.gradle
@@ -122,6 +122,7 @@ Closure commonPackageConfig(String type, boolean oss) {
       }
       from(rootProject.projectDir) {
         include 'README.textile'
+        fileMode 0644
       }
       into('modules') {
         with copySpec {
@@ -135,6 +136,11 @@ Closure commonPackageConfig(String type, boolean oss) {
             for (int i = segments.length - 2; i > 0 && segments[i] != 'modules'; --i) {
               directory('/' + segments[0..i].join('/'), 0755)
             }
+            if (segments[-2] == 'bin') {
+              fcp.mode = 0755
+            } else {
+              fcp.mode = 0644
+            }
           }
         }
       }
@@ -153,6 +159,7 @@ Closure commonPackageConfig(String type, boolean oss) {
           include oss ? 'APACHE-LICENSE-2.0.txt' : 'ELASTIC-LICENSE.txt'
           rename { 'LICENSE.txt' }
         }
+        fileMode 0644
       }
     }
 
@@ -181,14 +188,17 @@ Closure commonPackageConfig(String type, boolean oss) {
     configurationFile '/usr/lib/systemd/system/elasticsearch.service'
     into('/usr/lib/tmpfiles.d') {
       from "${packagingFiles}/systemd/elasticsearch.conf"
+      fileMode 0644
     }
     into('/usr/lib/systemd/system') {
       fileType CONFIG | NOREPLACE
       from "${packagingFiles}/systemd/elasticsearch.service"
+      fileMode 0644
     }
     into('/usr/lib/sysctl.d') {
       fileType CONFIG | NOREPLACE
       from "${packagingFiles}/systemd/sysctl/elasticsearch.conf"
+      fileMode 0644
     }
 
     // ========= sysV init =========