diff --git a/openwrt/patch/generic/0005-rootfs-add-r-w-permissions-for-UCI-configuration-fil.patch b/openwrt/patch/generic/0005-rootfs-add-r-w-permissions-for-UCI-configuration-fil.patch
new file mode 100644
index 000000000..64a2300b8
--- /dev/null
+++ b/openwrt/patch/generic/0005-rootfs-add-r-w-permissions-for-UCI-configuration-fil.patch
@@ -0,0 +1,25 @@
+From af683d8e4a586ad454224d2c67757e71361c4a3a Mon Sep 17 00:00:00 2001
+From: sbwml <admin@cooluc.com>
+Date: Sun, 30 Jun 2024 21:58:24 +0800
+Subject: [PATCH] rootfs: add r/w permissions for UCI configuration files
+
+Signed-off-by: sbwml <admin@cooluc.com>
+---
+ include/rootfs.mk | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/rootfs.mk b/include/rootfs.mk
+index eb69a99..f8bc2ed 100644
+--- a/include/rootfs.mk
++++ b/include/rootfs.mk
+@@ -100,6 +100,7 @@ define prepare_rootfs
+ 			$(STAGING_DIR_HOST)/bin/upx --lzma --best "$(1)$$file" || true; \
+ 		done < "$(TOPDIR)/upx_list.txt"; \
+ 	fi
++	chmod 600 $(1)/etc/config/*
+ 	$(call clean_ipkg,$(1))
+ 	$(call mklibs,$(1))
+ 	$(if $(SOURCE_DATE_EPOCH),find $(1)/ -mindepth 1 -execdir touch -hcd "@$(SOURCE_DATE_EPOCH)" "{}" +)
+-- 
+2.42.0
+
diff --git a/openwrt/scripts/00-prepare_base.sh b/openwrt/scripts/00-prepare_base.sh
index 328e51a1d..43b945e04 100644
--- a/openwrt/scripts/00-prepare_base.sh
+++ b/openwrt/scripts/00-prepare_base.sh
@@ -29,6 +29,10 @@ curl -s https://$mirror/openwrt/patch/generic/0003-kernel-Add-support-for-llvm-c
 # toolchain: Add libquadmath to the toolchain
 curl -s https://$mirror/openwrt/patch/generic/0004-libquadmath-Add-libquadmath-to-the-toolchain.patch | patch -p1
 
+# rootfs: add r/w (0600) permissions for UCI configuration files
+# include/rootfs.mk
+curl -s https://$mirror/openwrt/patch/generic/0005-rootfs-add-r-w-permissions-for-UCI-configuration-fil.patch | patch -p1
+
 # meson: add platform variable to cross-compilation file
 curl -s https://$mirror/openwrt/patch/generic/010-meson-add-platform-variable-to-cross-compilation-file.patch | patch -p1