diff --git a/cmd/cue/cmd/add.go b/cmd/cue/cmd/add.go
index e5218424898..98f3a842a2d 100644
--- a/cmd/cue/cmd/add.go
+++ b/cmd/cue/cmd/add.go
@@ -202,7 +202,7 @@ func (fo *originalFile) restore() error {
 	if len(fo.contents) == 0 {
 		return os.Remove(fo.filename)
 	}
-	return os.WriteFile(fo.filename, fo.contents, 0644)
+	return os.WriteFile(fo.filename, fo.contents, 0666)
 }
 
 type fileInfo struct {
@@ -287,7 +287,7 @@ func (fi *fileInfo) appendAndCheck() (fo originalFile, err error) {
 		return originalFile{}, err
 	}
 
-	if err = os.WriteFile(fi.filename, b, 0644); err != nil {
+	if err = os.WriteFile(fi.filename, b, 0666); err != nil {
 		// Just in case, attempt to restore original file.
 		_ = fo.restore()
 		return originalFile{}, err
diff --git a/cmd/cue/cmd/fix.go b/cmd/cue/cmd/fix.go
index 9273f4d57ef..50cbb2b11a0 100644
--- a/cmd/cue/cmd/fix.go
+++ b/cmd/cue/cmd/fix.go
@@ -104,7 +104,7 @@ func runFixAll(cmd *Command, args []string) error {
 					return err
 				}
 			} else {
-				if err := os.WriteFile(f.Filename, b, 0644); err != nil {
+				if err := os.WriteFile(f.Filename, b, 0666); err != nil {
 					errs = errors.Append(errs, errors.Promote(err, "write"))
 				}
 			}
diff --git a/cmd/cue/cmd/fmt.go b/cmd/cue/cmd/fmt.go
index b91edd3d347..c35ace87278 100644
--- a/cmd/cue/cmd/fmt.go
+++ b/cmd/cue/cmd/fmt.go
@@ -223,7 +223,7 @@ func formatFile(file *build.File, opts []format.Option, doDiff, check bool, cmd
 	case file.Filename == "-":
 		// already wrote the formatted source to stdout above
 	default:
-		if err := os.WriteFile(file.Filename, formatted, 0644); err != nil {
+		if err := os.WriteFile(file.Filename, formatted, 0666); err != nil {
 			return false, err
 		}
 	}
diff --git a/cmd/cue/cmd/import.go b/cmd/cue/cmd/import.go
index e74227b900c..ec849c92091 100644
--- a/cmd/cue/cmd/import.go
+++ b/cmd/cue/cmd/import.go
@@ -496,8 +496,8 @@ func writeFile(p *buildPlan, f *ast.File, cueFile string) error {
 		_, err := p.cmd.OutOrStdout().Write(b)
 		return err
 	}
-	_ = os.MkdirAll(filepath.Dir(cueFile), 0755)
-	return os.WriteFile(cueFile, b, 0644)
+	_ = os.MkdirAll(filepath.Dir(cueFile), 0777)
+	return os.WriteFile(cueFile, b, 0666)
 }
 
 type hoister struct {
diff --git a/cmd/cue/cmd/modinit.go b/cmd/cue/cmd/modinit.go
index 3a92466cb0f..c6e3ae5f1ef 100644
--- a/cmd/cue/cmd/modinit.go
+++ b/cmd/cue/cmd/modinit.go
@@ -84,7 +84,7 @@ func runModInit(cmd *Command, args []string) (err error) {
 		return err
 	}
 
-	err = os.Mkdir(mod, 0755)
+	err = os.Mkdir(mod, 0777)
 	if err != nil && !os.IsExist(err) {
 		return err
 	}
@@ -97,10 +97,10 @@ func runModInit(cmd *Command, args []string) (err error) {
 		return err
 	}
 
-	if err = os.Mkdir(filepath.Join(mod, "usr"), 0755); err != nil {
+	if err = os.Mkdir(filepath.Join(mod, "usr"), 0777); err != nil {
 		return err
 	}
-	if err = os.Mkdir(filepath.Join(mod, "pkg"), 0755); err != nil {
+	if err = os.Mkdir(filepath.Join(mod, "pkg"), 0777); err != nil {
 		return err
 	}
 
diff --git a/cmd/cue/cmd/trim.go b/cmd/cue/cmd/trim.go
index b87486d962f..553c060a628 100644
--- a/cmd/cue/cmd/trim.go
+++ b/cmd/cue/cmd/trim.go
@@ -181,7 +181,7 @@ func runTrim(cmd *Command, args []string) error {
 				filename = dst
 			}
 
-			err = os.WriteFile(filename, b, 0644)
+			err = os.WriteFile(filename, b, 0666)
 			if err != nil {
 				return err
 			}
diff --git a/cue/interpreter/wasm/wasm_test.go b/cue/interpreter/wasm/wasm_test.go
index ca89d267be6..53e38d3c8c5 100644
--- a/cue/interpreter/wasm/wasm_test.go
+++ b/cue/interpreter/wasm/wasm_test.go
@@ -117,7 +117,7 @@ func check(t *testing.T, dir string, got string) {
 	golden := filepath.Join("testdata", dir) + ".golden"
 
 	if cuetest.UpdateGoldenFiles {
-		os.WriteFile(golden, []byte(got), 0644)
+		os.WriteFile(golden, []byte(got), 0666)
 	}
 
 	want := string(must(os.ReadFile(golden))(t))
diff --git a/cue/load/loader_test.go b/cue/load/loader_test.go
index b011cab948b..f32c10078af 100644
--- a/cue/load/loader_test.go
+++ b/cue/load/loader_test.go
@@ -731,7 +731,7 @@ package %s
 
 x: 1
 `, string(c))
-		err := os.WriteFile(filepath.Join(testDir, string(c)+".cue"), []byte(contents), 0o644)
+		err := os.WriteFile(filepath.Join(testDir, string(c)+".cue"), []byte(contents), 0o666)
 		qt.Assert(t, qt.IsNil(err))
 	}
 
diff --git a/cue/testdata/gen.go b/cue/testdata/gen.go
index 3a63281f1b6..8fd0c433348 100644
--- a/cue/testdata/gen.go
+++ b/cue/testdata/gen.go
@@ -259,7 +259,7 @@ func (e *extractor) extractTest(x *ast.CompositeLit) {
 
 	e.a.Comment = e.header.Bytes()
 
-	_ = os.Mkdir(e.dir, 0755)
+	_ = os.Mkdir(e.dir, 0777)
 
 	name := fmt.Sprintf("%03d", e.count)
 	if e.name != "" {
@@ -268,7 +268,7 @@ func (e *extractor) extractTest(x *ast.CompositeLit) {
 	name = strings.ReplaceAll(name, " ", "_")
 	name = strings.ReplaceAll(name, ":", "_")
 	filename := filepath.Join(e.dir, name+".txtar")
-	err := os.WriteFile(filename, txtar.Format(e.a), 0644)
+	err := os.WriteFile(filename, txtar.Format(e.a), 0666)
 	if err != nil {
 		e.fatalf("Could not write file: %v", err)
 	}
diff --git a/encoding/gocode/testdata/gen.go b/encoding/gocode/testdata/gen.go
index e300aa38210..5443603ae20 100644
--- a/encoding/gocode/testdata/gen.go
+++ b/encoding/gocode/testdata/gen.go
@@ -58,7 +58,7 @@ func main() {
 		}
 
 		goFile := filepath.Join("testdata", d.Name(), "cue_gen.go")
-		if err := os.WriteFile(goFile, b, 0644); err != nil {
+		if err := os.WriteFile(goFile, b, 0666); err != nil {
 			log.Fatal(err)
 		}
 	}
diff --git a/encoding/openapi/decode_test.go b/encoding/openapi/decode_test.go
index bfccc591356..5ed66ba2d4a 100644
--- a/encoding/openapi/decode_test.go
+++ b/encoding/openapi/decode_test.go
@@ -110,7 +110,7 @@ func TestDecode(t *testing.T) {
 					if cuetest.UpdateGoldenFiles {
 						a.Files[outIndex].Data = b
 						b = txtar.Format(a)
-						err = os.WriteFile(fullpath, b, 0644)
+						err = os.WriteFile(fullpath, b, 0666)
 						if err != nil {
 							t.Fatal(err)
 						}
diff --git a/encoding/openapi/openapi_test.go b/encoding/openapi/openapi_test.go
index b9765b6871e..4e7e8840418 100644
--- a/encoding/openapi/openapi_test.go
+++ b/encoding/openapi/openapi_test.go
@@ -251,7 +251,7 @@ func TestParseDefinitions(t *testing.T) {
 
 				wantFile := filepath.Join("testdata", tc.out)
 				if cuetest.UpdateGoldenFiles {
-					_ = os.WriteFile(wantFile, out.Bytes(), 0644)
+					_ = os.WriteFile(wantFile, out.Bytes(), 0666)
 					return
 				}
 
diff --git a/encoding/protobuf/protobuf_test.go b/encoding/protobuf/protobuf_test.go
index 3d1a5303cc1..c0869611672 100644
--- a/encoding/protobuf/protobuf_test.go
+++ b/encoding/protobuf/protobuf_test.go
@@ -57,7 +57,7 @@ func TestExtractDefinitions(t *testing.T) {
 
 			wantFile := filepath.Join("testdata", filepath.Base(file)+".out.cue")
 			if cuetest.UpdateGoldenFiles {
-				_ = os.WriteFile(wantFile, out.Bytes(), 0644)
+				_ = os.WriteFile(wantFile, out.Bytes(), 0666)
 				return
 			}
 
@@ -102,8 +102,8 @@ func TestBuild(t *testing.T) {
 			if err != nil {
 				t.Fatal(err)
 			}
-			_ = os.MkdirAll(filepath.Dir(f.Filename), 0755)
-			err = os.WriteFile(f.Filename, b, 0644)
+			_ = os.MkdirAll(filepath.Dir(f.Filename), 0777)
+			err = os.WriteFile(f.Filename, b, 0666)
 			if err != nil {
 				t.Fatal(err)
 			}
diff --git a/internal/core/adt/debug.go b/internal/core/adt/debug.go
index b55e11d352c..1fc4b051252 100644
--- a/internal/core/adt/debug.go
+++ b/internal/core/adt/debug.go
@@ -68,7 +68,7 @@ func OpenNodeGraph(title, path, code, out, graph string) {
 	}
 	numberOpened++
 
-	err := os.MkdirAll(path, 0755)
+	err := os.MkdirAll(path, 0777)
 	if err != nil {
 		log.Fatal(err)
 	}
diff --git a/internal/encoding/encoder.go b/internal/encoding/encoder.go
index e44eb724c62..028422cd442 100644
--- a/internal/encoding/encoder.go
+++ b/internal/encoding/encoder.go
@@ -310,7 +310,7 @@ func writer(f *build.File, cfg *Config) (_ io.Writer, close func() error, err er
 			// Swap O_EXCL for O_TRUNC to allow replacing an entire existing file.
 			mode = os.O_WRONLY | os.O_CREATE | os.O_TRUNC
 		}
-		f, err := os.OpenFile(path, mode, 0o644)
+		f, err := os.OpenFile(path, mode, 0o666)
 		if err != nil {
 			if errors.Is(err, fs.ErrExist) {
 				return errors.Wrapf(fs.ErrExist, token.NoPos, "error writing %q", path)
diff --git a/internal/encoding/yaml/decode_test.go b/internal/encoding/yaml/decode_test.go
index 29613848f50..8bf6b0d4365 100644
--- a/internal/encoding/yaml/decode_test.go
+++ b/internal/encoding/yaml/decode_test.go
@@ -971,7 +971,7 @@ func TestFiles(t *testing.T) {
 			}
 			got := cueStr(expr)
 			if cuetest.UpdateGoldenFiles {
-				os.WriteFile(filename, []byte(got), 0644)
+				os.WriteFile(filename, []byte(got), 0666)
 				return
 			}
 			b, err := os.ReadFile(filename)
diff --git a/pkg/qgo.go b/pkg/qgo.go
index 36d11c49caa..6544f18824b 100644
--- a/pkg/qgo.go
+++ b/pkg/qgo.go
@@ -155,7 +155,7 @@ func extract(args []string) {
 			if err != nil {
 				log.Fatal(err)
 			}
-			err = os.WriteFile(lastPkg+".go", b, 0644)
+			err = os.WriteFile(lastPkg+".go", b, 0666)
 			if err != nil {
 				log.Fatal(err)
 			}