diff --git a/global/fs/default.nix b/global/fs/default.nix
index 4805dc3e..0871b015 100644
--- a/global/fs/default.nix
+++ b/global/fs/default.nix
@@ -90,5 +90,10 @@ in {
       inherit (cfg.cryptsetup) allowDiscards bypassWorkqueues;
       device = "/dev/disk/by-uuid/${uuid}";
     }) cfg.cryptsetup.uuids);
+
+    environment.persistence."/nix/persist/fhs".files = [ {
+      file = "/var/lib/private/mode";
+      parentDirectory.mode = "0700";
+    } ];
   };
 }