diff --git a/tools/mkboot b/tools/mkboot
index 0f022f2b1..76fe3aa48 100755
--- a/tools/mkboot
+++ b/tools/mkboot
@@ -98,8 +98,8 @@ hdboot)
 	esac
 
 	# Install the new image.
-	echo "cp image $root:/boot/image/$target"
-	cp -p image $rootdir/boot/image/$target || exit
+	echo "install image $root:/boot/image/$target"
+	install -o root -m 600 image $rootdir/boot/image/$target || exit
 
 	# Save the revision number.
 	test "$revision" != "$oldrev" && echo $revision >revision
diff --git a/tools/release.sh b/tools/release.sh
index fb87616a5..6c95bc2d4 100755
--- a/tools/release.sh
+++ b/tools/release.sh
@@ -45,7 +45,8 @@ mkdir -p $RELEASEDIR
 mkfs -b 1440 -B 1024 $RAM || exit
 echo " * mounting $RAM as $RELEASEDIR"
 mount $RAM $RELEASEDIR || exit
-mkdir $RELEASEDIR/usr $RELEASEDIR/tmp
+mkdir -m 755 $RELEASEDIR/usr
+mkdir -m 1777 $RELEASEDIR/tmp
 mount $TMPTMPDISK $RELEASEDIR/tmp || exit 1
 
 mkfs -B 1024 $TMPDISK