diff --git a/ops/nixos/lib/baserow.nix b/ops/nixos/lib/baserow.nix
index 17ffba58f3..1d6efe44ae 100644
--- a/ops/nixos/lib/baserow.nix
+++ b/ops/nixos/lib/baserow.nix
@@ -208,4 +208,5 @@ in
     domains = "csl:baserow.lukegb.com";
     selector = "totoro";
   };
+  systemd.services.opendkim.serviceConfig.UMask = lib.mkForce "0007";
 }