diff --git a/global/pre-tasks.d/015set-overlay-permissions b/global/pre-tasks.d/015set-overlay-permissions
new file mode 100755
index 0000000..373ef68
--- /dev/null
+++ b/global/pre-tasks.d/015set-overlay-permissions
@@ -0,0 +1,19 @@
+#!/bin/sh
+#
+# Set overlay file permissions in model directory before apply.d/60overlay
+# rsyncs it to /
+#
+
+set -e
+self=$(basename "$0")
+
+MODEL_OVERLAY="$COSMOS_MODEL/overlay"
+
+if ! test -d "$MODEL_OVERLAY"; then
+    test -z "$COSMOS_VERBOSE" || echo "$self: overlay is a no-op"
+    exit 0
+fi
+
+if [ -d "$MODEL_OVERLAY/root" ]; then
+    chmod -v 0700 "$MODEL_OVERLAY"/root
+fi