diff --git a/src/Module/Proxy.php b/src/Module/Proxy.php
index f20b13bcef..10ddd56334 100644
--- a/src/Module/Proxy.php
+++ b/src/Module/Proxy.php
@@ -131,7 +131,9 @@ class Proxy extends BaseModule
 		// Store original image
 		if ($direct_cache) {
 			// direct cache , store under ./proxy/
-			file_put_contents($basepath . '/proxy/' . ProxyUtils::proxifyUrl($request['url'], true), $image->asString());
+			$filename = $basepath . '/proxy/' . ProxyUtils::proxifyUrl($request['url'], true);
+			file_put_contents($filename, $image->asString());
+			chmod($filename, DI::config()->get('system', 'proxy_file_chmod'));
 		} elseif($cachefile !== '') {
 			// cache file
 			file_put_contents($cachefile, $image->asString());
@@ -149,7 +151,9 @@ class Proxy extends BaseModule
 
 		// Store scaled image
 		if ($direct_cache && $request['sizetype'] != '') {
-			file_put_contents($basepath . '/proxy/' . ProxyUtils::proxifyUrl($request['url'], true) . $request['sizetype'], $image->asString());
+			$filename = $basepath . '/proxy/' . ProxyUtils::proxifyUrl($request['url'], true) . $request['sizetype'];
+			file_put_contents($filename, $image->asString());
+			chmod($filename, DI::config()->get('system', 'proxy_file_chmod'));
 		}
 
 		self::responseImageHttpCache($image);
diff --git a/static/defaults.config.php b/static/defaults.config.php
index 7578e3c550..b075db36a0 100644
--- a/static/defaults.config.php
+++ b/static/defaults.config.php
@@ -570,6 +570,10 @@ return [
 		// xrd_timeout (Integer)
 		// Timeout in seconds for fetching the XRD links.
 		'xrd_timeout' => 20,
+
+		// proxy_file_chmod (Integer)
+		// Access rights for downloaded files in /proxy/ directory
+		'proxy_file_chmod' => 0640,
 	],
 	'experimental' => [
 		// exp_themes (Boolean)