diff --git a/flake.lock b/flake.lock
index 4bf099a..a40dcad 100644
--- a/flake.lock
+++ b/flake.lock
@@ -150,16 +150,16 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1771848320,
-        "narHash": "sha256-0MAd+0mun3K/Ns8JATeHT1sX28faLII5hVLq0L3BdZU=",
+        "lastModified": 1771903837,
+        "narHash": "sha256-sdaqdnsQCv3iifzxwB22tUwN/fSHoN7j2myFW5EIkGk=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "2fc6539b481e1d2569f25f8799236694180c0993",
+        "rev": "e764fc9a405871f1f6ca3d1394fb422e0a0c3951",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-unstable",
+        "ref": "nixos-25.11",
         "repo": "nixpkgs",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index ef32d11..36b817f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,7 +2,7 @@
     description = "Stationette nix config";
 
     inputs = {
-        nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+        nixpkgs.url = "github:nixos/nixpkgs/nixos-25.11";
         disko.url = "github:nix-community/disko/latest";
         impermanence.url = "github:nix-community/impermanence";
         home-manager.url = "github:nix-community/home-manager/release-25.11";
@@ -60,6 +60,7 @@
                                                     type = "filesystem";
                                                     format = "vfat";
                                                     mountpoint = "/boot";
+                                                    mountOptions = [ "fmask=0022" "dmask=0022" "umask=0077" ];
                                                 };
                                             };
                                             root = {
diff --git a/hardware-configuration.nix b/hardware-configuration.nix
index 5dcc062..0f3fa41 100644
--- a/hardware-configuration.nix
+++ b/hardware-configuration.nix
@@ -59,7 +59,7 @@
     fileSystems."/boot" = {
         device = "/dev/disk/by-partlabel/disk-stationette-ESP";
         fsType = "vfat";
-        options = [ "fmask=0022" "dmask=0022" ];
+        options = [ "fmask=0022" "dmask=0022" "umask=0077" ];
     };
 
     swapDevices = [ ];