diff --git a/package_manager/tests/src/Kernel/PathExcluder/SiteConfigurationExcluderTest.php b/package_manager/tests/src/Kernel/PathExcluder/SiteConfigurationExcluderTest.php
index 0d72207fdf2af4f37daca482a39d09c93f415d8d..7f5fd7e5d80ee6ffb258f20b7fa6ce5d2ee63b8a 100644
--- a/package_manager/tests/src/Kernel/PathExcluder/SiteConfigurationExcluderTest.php
+++ b/package_manager/tests/src/Kernel/PathExcluder/SiteConfigurationExcluderTest.php
@@ -80,6 +80,34 @@ class SiteConfigurationExcluderTest extends PackageManagerKernelTestBase {
     }
   }
 
+  /**
+   * Tests that `sites/default` is made writable in the stage directory.
+   */
+  public function testDefaultSiteDirectoryPermissions(): void {
+    $project_root = $this->container->get(PathLocator::class)
+      ->getProjectRoot();
+    $live_dir = $project_root . '/sites/default';
+    chmod($live_dir, 0555);
+    $this->assertDirectoryIsNotWritable($live_dir);
+    // Record the permissions of the directory now, so we can be sure those
+    // permissions are restored after apply.
+    $original_permissions = fileperms($live_dir);
+    $this->assertIsInt($original_permissions);
+
+    $stage = $this->createStage();
+    $stage->create();
+    // The staged `sites/default` will be made world-writable, because we want
+    // to ensure the scaffold plugin can copy certain files into there.
+    $staged_dir = str_replace($project_root, $stage->getStageDirectory(), $live_dir);
+    $this->assertDirectoryIsWritable($staged_dir);
+
+    $stage->require(['ext-json:*']);
+    $stage->apply();
+    // After applying, the live directory should NOT inherit the staged
+    // directory's world-writable permissions.
+    $this->assertSame($original_permissions, fileperms($live_dir));
+  }
+
 }
 
 /**