diff --git a/CHANGELOG.md b/CHANGELOG.md
index 697558e6..6915cc01 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,9 @@
 - use old crypt lib in python < 3.11
   ([#483](https://github.com/deltachat/chatmail/pull/483))
 
+- chatmaild: set umask to 0700 for doveauth + metadata
+  ([#490](https://github.com/deltachat/chatmail/pull/492))
+
 - remove MTA-STS daemon
   ([#488](https://github.com/deltachat/chatmail/pull/488))
 
diff --git a/cmdeploy/src/cmdeploy/service/chatmail-metadata.service.f b/cmdeploy/src/cmdeploy/service/chatmail-metadata.service.f
index b178819d..117884f4 100644
--- a/cmdeploy/src/cmdeploy/service/chatmail-metadata.service.f
+++ b/cmdeploy/src/cmdeploy/service/chatmail-metadata.service.f
@@ -7,6 +7,7 @@
 RestartSec=30
 User=vmail
 RuntimeDirectory=chatmail-metadata
+UMask=0700
 
 [Install]
 WantedBy=multi-user.target
diff --git a/cmdeploy/src/cmdeploy/service/doveauth.service.f b/cmdeploy/src/cmdeploy/service/doveauth.service.f
index 657430d3..b85b0075 100644
--- a/cmdeploy/src/cmdeploy/service/doveauth.service.f
+++ b/cmdeploy/src/cmdeploy/service/doveauth.service.f
@@ -7,6 +7,7 @@
 RestartSec=30
 User=vmail
 RuntimeDirectory=doveauth
+UMask=0700
 
 [Install]
 WantedBy=multi-user.target