diff --git a/scripts/provision-existing-users.sh b/scripts/provision-existing-users.sh
index d10abeea..55511413 100755
--- a/scripts/provision-existing-users.sh
+++ b/scripts/provision-existing-users.sh
@@ -161,9 +161,9 @@ while IFS='|' read -r email username; do
   sudo mkdir -p "$HOME_DIR/.pi/agent/sessions"
 
   # Set ownership and permissions last
-  # chmod 775 so the service user (in the user's group) can read/write for background jobs
+  # chmod 770 so only owner and group can access (service user is added to group above)
   sudo chown -R "$shell_user:$shell_user" "$USER_ROOT"
-  sudo chmod -R 775 "$USER_ROOT"
+  sudo chmod -R 770 "$USER_ROOT"
 
   # Add service user to this user's group so server jobs can access user data
   SERVICE_USER="${SUDO_USER:-$(whoami)}"
diff --git a/src/servers/api/users/provision.ts b/src/servers/api/users/provision.ts
index e62f1398..b28b86b0 100644
--- a/src/servers/api/users/provision.ts
+++ b/src/servers/api/users/provision.ts
@@ -48,10 +48,9 @@ export async function provisionLinuxUser(email: string, username: string): Promi
   }
 
   // Set ownership and permissions on user data directory
-  // chmod 775 so the service user (in the user's group) can read/write for background jobs
-  // The service user is added to the group below, so group permissions (rwx) are needed
+  // chmod 770 so only owner and group can access (service user is added to group below)
   run(['sudo', 'chown', '-R', `${shellUsername}:${shellUsername}`, userRoot]);
-  run(['sudo', 'chmod', '-R', '775', userRoot]); // Recursive chmod to fix all subdirectories
+  run(['sudo', 'chmod', '-R', '770', userRoot]); // Recursive chmod to fix all subdirectories
 
   // Add the service user to the new user's group so server jobs can access user data
   const serviceUser = process.env.USER ?? '';
@@ -77,7 +76,7 @@ export async function provisionLinuxUser(email: string, username: string): Promi
 
   // Fix ownership and permissions after seeding
   run(['sudo', 'chown', '-R', `${shellUsername}:${shellUsername}`, userRoot]);
-  run(['sudo', 'chmod', '-R', '775', userRoot]);
+  run(['sudo', 'chmod', '-R', '770', userRoot]);
 
   console.log(`[provision] provisioning complete for ${shellUsername}`);
   return true;