diff --git a/oml/item/models.py b/oml/item/models.py
index 56b14ad..b207208 100644
--- a/oml/item/models.py
+++ b/oml/item/models.py
@@ -578,8 +578,9 @@ class Item(db.Model):
         for f in self.files.all():
             path = f.fullpath()
             if os.path.exists(path):
+                mode = 0o644
                 try:
-                    os.chmod(path, stat.S_IWRITE)
+                    os.chmod(path, mode)
                     os.unlink(path)
                     remove_empty_folders(os.path.dirname(path))
                 except:
@@ -725,7 +726,7 @@ class File(db.Model):
         current_path = self.fullpath()
         if os.path.exists(current_path):
             mode = os.stat(current_path)[stat.ST_MODE]
-            readonly = mode & ~stat.S_IWUSR & ~stat.S_IWGRP & ~stat.S_IWOTH
+            readonly = 0o444
             if mode != readonly:
                 os.chmod(current_path, readonly)
 
@@ -787,8 +788,9 @@ class File(db.Model):
         if self.path != new_path:
             path = os.path.join(prefix, new_path)
             ox.makedirs(os.path.dirname(path))
+            mode = 0o644
             try:
-                os.chmod(current_path, stat.S_IWRITE)
+                os.chmod(current_path, mode)
                 shutil.move(current_path, path)
             except:
                 logger.debug('failed to move %s to %s', current_path, path, exc_info=True)