diff --git a/build/functions.cmake b/build/functions.cmake
index b3dd44d..8d94e3f 100644
--- a/build/functions.cmake
+++ b/build/functions.cmake
@@ -93,7 +93,7 @@ function(fn__build_zip # create zip archive at build time
   add_custom_command(
     OUTPUT "${PATH_OUT}" # still relative to CMAKE_CURRENT_BINARY_DIR
     DEPENDS ${FILES_IN_ABS}  # absolute paths required for DEPENDS
-    COMMAND "${CMAKE_COMMAND}" -E tar cf "${PATH_OUT_ABS}" --format=zip -- ${FILES_IN}
+    COMMAND "${CMAKE_COMMAND}" -E tar --mode=go=rX,u+rw,a-s cf "${PATH_OUT_ABS}" --format=zip -- ${FILES_IN}
     WORKING_DIRECTORY "${DIR_IN}" # run command in this directory
     COMMENT "Compressing '${PATH_OUT}'"
     VERBATIM