diff --git a/internal/cache/cache.go b/internal/cache/cache.go
index 6f3f93be..35d6155a 100644
--- a/internal/cache/cache.go
+++ b/internal/cache/cache.go
@@ -61,7 +61,7 @@ func Open(dir string) (*Cache, error) {
 	}
 	for i := 0; i < 256; i++ {
 		name := filepath.Join(dir, fmt.Sprintf("%02x", i))
-		if err := os.MkdirAll(name, 0777); err != nil {
+		if err := os.MkdirAll(name, 0744); err != nil {
 			return nil, err
 		}
 	}
diff --git a/internal/cache/cache_test.go b/internal/cache/cache_test.go
index 7229bc4c..bc2b90d5 100644
--- a/internal/cache/cache_test.go
+++ b/internal/cache/cache_test.go
@@ -31,7 +31,7 @@ func TestBasic(t *testing.T) {
 	}
 
 	cdir := filepath.Join(dir, "c1")
-	if err := os.Mkdir(cdir, 0777); err != nil {
+	if err := os.Mkdir(cdir, 0744); err != nil {
 		t.Fatal(err)
 	}
 
diff --git a/internal/cache/default.go b/internal/cache/default.go
index 6b7d8b4f..162bcc97 100644
--- a/internal/cache/default.go
+++ b/internal/cache/default.go
@@ -34,7 +34,7 @@ const cacheREADME = `This directory holds cached build artifacts from golangci-l
 // the first time Default is called.
 func initDefaultCache() {
 	dir := DefaultDir()
-	if err := os.MkdirAll(dir, 0777); err != nil {
+	if err := os.MkdirAll(dir, 0744); err != nil {
 		log.Fatalf("failed to initialize build cache at %s: %s\n", dir, err)
 	}
 	if _, err := os.Stat(filepath.Join(dir, "README")); err != nil {