diff --git a/nixos/modules/services/networking/zeronsd.nix b/nixos/modules/services/networking/zeronsd.nix
index 23f1a5fa7e4f..25e7c03395bf 100644
--- a/nixos/modules/services/networking/zeronsd.nix
+++ b/nixos/modules/services/networking/zeronsd.nix
@@ -102,7 +102,7 @@ in
     }) cfg.servedNetworks;
 
     systemd.tmpfiles.rules = [
-      "a+ /var/lib/zerotier-one - - - - u:zeronsd:x"
+      "a+ /var/lib/zerotier-one - - - - mask::x,u:zeronsd:x"
       "a+ /var/lib/zerotier-one/authtoken.secret - - - - mask::r,u:zeronsd:r"
     ];