diff --git a/Makefile b/Makefile
index e3ebc4e99..da6e1b77c 100644
--- a/Makefile
+++ b/Makefile
@@ -105,7 +105,7 @@ security:
 	go tool govulncheck ./... > tests/govulncheck-report.txt || true
 	@echo "Govulncheck report saved to tests/govulncheck-report.txt"
 
-	go tool gosec ./... > tests/gosec-report.txt || true
+	go tool gosec -exclude=G204,G304,G402 ./... > tests/gosec-report.txt || true
 	@echo "Gosec report saved to tests/gosec-report.txt"
 
 	go tool staticcheck -checks="all,-ST1000,-ST1003,-ST1016,-ST1020,-ST1021,-ST1022,-SA1019,-SA9005" ./...  > tests/staticcheck-report.txt || true
diff --git a/cmd/hive/cmd/admin.go b/cmd/hive/cmd/admin.go
index 3f86d01e8..9dd4efba4 100644
--- a/cmd/hive/cmd/admin.go
+++ b/cmd/hive/cmd/admin.go
@@ -377,7 +377,7 @@ func runimagesImportCmd(cmd *cobra.Command, args []string) {
 
 	manifestFilename := fmt.Sprintf("%s/%s.json", imagePath, manifest.AMIMetadata.Name)
 	// Write to file
-	err = os.WriteFile(manifestFilename, jsonData, 0644)
+	err = os.WriteFile(manifestFilename, jsonData, 0600)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "Could not write manifest: %v\n", err)
 		os.Exit(1)
@@ -850,7 +850,7 @@ func runAdminJoin(cmd *cobra.Command, args []string) {
 		caCertPath := filepath.Join(configDir, "ca.pem")
 		caKeyPath := filepath.Join(configDir, "ca.key")
 
-		if err := os.WriteFile(caCertPath, []byte(joinResp.CACert), 0644); err != nil {
+		if err := os.WriteFile(caCertPath, []byte(joinResp.CACert), 0600); err != nil {
 			fmt.Fprintf(os.Stderr, "Error writing CA cert: %v\n", err)
 			os.Exit(1)
 		}
diff --git a/hive/admin/admin.go b/hive/admin/admin.go
index e130592b3..a20badcc3 100644
--- a/hive/admin/admin.go
+++ b/hive/admin/admin.go
@@ -172,7 +172,7 @@ func CreateServiceDirectories(hiveRoot string) {
 
 		// Check if directory exists
 		if _, err := os.Stat(dir); os.IsNotExist(err) {
-			if err := os.MkdirAll(dir, 0755); err != nil {
+			if err := os.MkdirAll(dir, 0750); err != nil {
 				fmt.Fprintf(os.Stderr, "Warning: Could not create %s: %v\n", dir, err)
 			}
 		}
diff --git a/hive/handlers/ec2/instance/service_impl.go b/hive/handlers/ec2/instance/service_impl.go
index bc7ec1912..3cdc78498 100644
--- a/hive/handlers/ec2/instance/service_impl.go
+++ b/hive/handlers/ec2/instance/service_impl.go
@@ -639,7 +639,7 @@ func (s *InstanceServiceImpl) createCloudInitISO(input *ec2.RunInstancesInput, i
 
 	slog.Info("Created temp ISO file", "file", tempFile.Name())
 
-	outputFile, err := os.OpenFile(tempFile.Name(), os.O_WRONLY|os.O_TRUNC|os.O_CREATE, 0644)
+	outputFile, err := os.OpenFile(tempFile.Name(), os.O_WRONLY|os.O_TRUNC|os.O_CREATE, 0600)
 	if err != nil {
 		slog.Error("failed to create file", "err", err)
 		return errors.New(awserrors.ErrorServerInternal)