diff --git a/docs/changelog.rst b/docs/changelog.rst
index 748cdca..43c04ba 100644
--- a/docs/changelog.rst
+++ b/docs/changelog.rst
@@ -1,6 +1,7 @@
 Changelog
 =========
 
+* :support:`-` restrict permissions of mailbox base directories to be read only
 * :feature:`-` add new mailbox handling tasks
   :py:func:`osusers.tasks.create_file_mailbox` and
   :py:func:`osusers.tasks.delete_file_mailbox`
diff --git a/gvafile/osusers/tasks.py b/gvafile/osusers/tasks.py
index 8e4ffb2..4a7105c 100644
--- a/gvafile/osusers/tasks.py
+++ b/gvafile/osusers/tasks.py
@@ -111,7 +111,7 @@ def setup_file_mail_userdir(username):
     try:
         subprocess.check_output([
             SUDO_CMD, INSTALL_CMD, '-o', username, '-g', username,
-            '-m', '0750', '-d', mail_directory], stderr=subprocess.STDOUT)
+            '-m', '0500', '-d', mail_directory], stderr=subprocess.STDOUT)
     except subprocess.CalledProcessError:
         _logger.exception(
             'could not create mail base directory for user %s', username)