diff --git a/project-lakitu/scripts/board_specific_setup.sh b/project-lakitu/scripts/board_specific_setup.sh
index 2e56ce3..fe38827 100644
--- a/project-lakitu/scripts/board_specific_setup.sh
+++ b/project-lakitu/scripts/board_specific_setup.sh
@@ -243,6 +243,9 @@
     "${root_fs_dir}"/lib/systemd/system \
     -type f -name *.timer | xargs sudo chmod go-wrx
 
+  # Set grub.cfg file permissions to 400 as recommended by CIS
+  sudo chmod 400 "${root_fs_dir}"/boot/efi/boot/grub.cfg
+
   local shim_arch=""
   if [[ "${ARCH}" == "amd64" ]]; then
     shim_arch="x64"