diff --git a/hosts/default.nix b/hosts/default.nix
index e187a40..419b55f 100644
--- a/hosts/default.nix
+++ b/hosts/default.nix
@@ -35,6 +35,7 @@ let
                   type = "filesystem";
                   format = "vfat";
                   mountpoint = "/boot";
+                  mountOptions = [ "umask=0077" ];
                   extraArgs = [ "-n" "BOOT" ];
                 };
               };