diff --git a/changes/fleetctl-update-permissions b/changes/fleetctl-update-permissions
new file mode 100644
index 0000000000..f16b20ea4b
--- /dev/null
+++ b/changes/fleetctl-update-permissions
@@ -0,0 +1 @@
+* Use stricter file permissions in `fleetctl updates add` command.
diff --git a/ee/fleetctl/updates.go b/ee/fleetctl/updates.go
index 2c1c9bd368..1d5674db88 100644
--- a/ee/fleetctl/updates.go
+++ b/ee/fleetctl/updates.go
@@ -595,11 +595,11 @@ func copyTarget(srcPath, dstPath string) error {
 	}
 	defer src.Close()
 
-	if err := secure.MkdirAll(filepath.Dir(dstPath), 0o755); err != nil {
+	if err := secure.MkdirAll(filepath.Dir(dstPath), 0o700); err != nil {
 		return fmt.Errorf("create dst dir for copy: %w", err)
 	}
 
-	dst, err := secure.OpenFile(dstPath, os.O_RDWR|os.O_CREATE, 0o644)
+	dst, err := secure.OpenFile(dstPath, os.O_RDWR|os.O_CREATE, 0o600)
 	if err != nil {
 		return fmt.Errorf("open dst for copy: %w", err)
 	}