diff --git a/src/extensions/nginx-app-protect/nap/nap.go b/src/extensions/nginx-app-protect/nap/nap.go
index c51d14d88..9d87c8fa9 100644
--- a/src/extensions/nginx-app-protect/nap/nap.go
+++ b/src/extensions/nginx-app-protect/nap/nap.go
@@ -24,7 +24,7 @@ const (
 	DefaultOptNAPDir      = "/opt/app_protect"
 	DefaultNMSCompilerDir = "/opt/nms-nap-compiler"
 	compilerDirPrefix     = "app_protect-"
-	dirPerm               = 0o644
+	dirPerm               = 0o750
 )
 
 var (
diff --git a/src/extensions/nginx-app-protect/nap/nap_metadata.go b/src/extensions/nginx-app-protect/nap/nap_metadata.go
index c1068fd4b..582d93bf9 100644
--- a/src/extensions/nginx-app-protect/nap/nap_metadata.go
+++ b/src/extensions/nginx-app-protect/nap/nap_metadata.go
@@ -94,7 +94,7 @@ func UpdateMetadata(
 	directory := filepath.Dir(appProtectWAFDetails.GetWafLocation())
 	_, err = os.Stat(directory)
 	if os.IsNotExist(err) {
-		err = os.MkdirAll(directory, 0o755)
+		err = os.MkdirAll(directory, 0o750)
 		if err != nil {
 			return fmt.Errorf("failed to create directory for metadata update: %v", err)
 		}
@@ -102,7 +102,7 @@ func UpdateMetadata(
 
 	log.Debugf("Writing NAP Metadata %s", m)
 
-	err = os.WriteFile(appProtectWAFDetails.GetWafLocation(), m, 0o664)
+	err = os.WriteFile(appProtectWAFDetails.GetWafLocation(), m, 0o644)
 	if err != nil {
 		return fmt.Errorf("failed to write NAP Metadata update: %v", err)
 	}
diff --git a/test/performance/vendor/github.com/nginx/agent/v2/src/extensions/nginx-app-protect/nap/nap.go b/test/performance/vendor/github.com/nginx/agent/v2/src/extensions/nginx-app-protect/nap/nap.go
index c51d14d88..9d87c8fa9 100644
--- a/test/performance/vendor/github.com/nginx/agent/v2/src/extensions/nginx-app-protect/nap/nap.go
+++ b/test/performance/vendor/github.com/nginx/agent/v2/src/extensions/nginx-app-protect/nap/nap.go
@@ -24,7 +24,7 @@ const (
 	DefaultOptNAPDir      = "/opt/app_protect"
 	DefaultNMSCompilerDir = "/opt/nms-nap-compiler"
 	compilerDirPrefix     = "app_protect-"
-	dirPerm               = 0o644
+	dirPerm               = 0o750
 )
 
 var (
diff --git a/test/performance/vendor/github.com/nginx/agent/v2/src/extensions/nginx-app-protect/nap/nap_metadata.go b/test/performance/vendor/github.com/nginx/agent/v2/src/extensions/nginx-app-protect/nap/nap_metadata.go
index c1068fd4b..582d93bf9 100644
--- a/test/performance/vendor/github.com/nginx/agent/v2/src/extensions/nginx-app-protect/nap/nap_metadata.go
+++ b/test/performance/vendor/github.com/nginx/agent/v2/src/extensions/nginx-app-protect/nap/nap_metadata.go
@@ -94,7 +94,7 @@ func UpdateMetadata(
 	directory := filepath.Dir(appProtectWAFDetails.GetWafLocation())
 	_, err = os.Stat(directory)
 	if os.IsNotExist(err) {
-		err = os.MkdirAll(directory, 0o755)
+		err = os.MkdirAll(directory, 0o750)
 		if err != nil {
 			return fmt.Errorf("failed to create directory for metadata update: %v", err)
 		}
@@ -102,7 +102,7 @@ func UpdateMetadata(
 
 	log.Debugf("Writing NAP Metadata %s", m)
 
-	err = os.WriteFile(appProtectWAFDetails.GetWafLocation(), m, 0o664)
+	err = os.WriteFile(appProtectWAFDetails.GetWafLocation(), m, 0o644)
 	if err != nil {
 		return fmt.Errorf("failed to write NAP Metadata update: %v", err)
 	}