diff --git a/package_manager/src/PathExcluder/SiteConfigurationExcluder.php b/package_manager/src/PathExcluder/SiteConfigurationExcluder.php
index 1745d92f4e4861ab3fe10683a0d42f6515659d8e..f98bef63fc79c339cc9ec43208c9927a1af2f814 100644
--- a/package_manager/src/PathExcluder/SiteConfigurationExcluder.php
+++ b/package_manager/src/PathExcluder/SiteConfigurationExcluder.php
@@ -67,7 +67,7 @@ class SiteConfigurationExcluder implements EventSubscriberInterface {
   }
 
   /**
-   * Makes the staged `sites/default` directory world-writable.
+   * Makes the staged `sites/default` directory owner-writable.
    *
    * This is done to allow the core scaffold plugin to make changes in
    * `sites/default`, if necessary, without breaking if `sites/default` is not
@@ -89,7 +89,7 @@ class SiteConfigurationExcluder implements EventSubscriberInterface {
     if (!is_dir($dir)) {
       return;
     }
-    if (!$this->fileSystem->chmod($dir, 0777)) {
+    if (!$this->fileSystem->chmod($dir, 0700)) {
       throw new FileException("Could not change permissions on '$dir'.");
     }
   }
diff --git a/package_manager/src/Plugin/QueueWorker/Cleaner.php b/package_manager/src/Plugin/QueueWorker/Cleaner.php
index b129563e280212d04d075c4150a434b70989c24a..fd82ee26c7cb5352f77356253ea4cac3d33d2ccc 100644
--- a/package_manager/src/Plugin/QueueWorker/Cleaner.php
+++ b/package_manager/src/Plugin/QueueWorker/Cleaner.php
@@ -54,7 +54,7 @@ final class Cleaner extends QueueWorkerBase implements ContainerFactoryPluginInt
 
     if (file_exists($dir)) {
       $this->fileSystem->deleteRecursive($dir, function (string $path): void {
-        $this->fileSystem->chmod($path, 0777);
+        $this->fileSystem->chmod($path, is_dir($path) ? 0700 : 0600);
       });
     }
   }
diff --git a/tests/src/Build/CoreUpdateTest.php b/tests/src/Build/CoreUpdateTest.php
index 55e10050adbfeb6c2e85c7aec414c8719b1e967c..ad5a0b58194dcb75b0c49fbc0258b3dd62dd8b6b 100644
--- a/tests/src/Build/CoreUpdateTest.php
+++ b/tests/src/Build/CoreUpdateTest.php
@@ -470,7 +470,7 @@ class CoreUpdateTest extends UpdateTestBase {
     $pattern = '/^Unused stage directory deleted: (.+)$/m';
     $matches = [];
     preg_match($pattern, $output, $matches);
-    $this->assertCount(2, $matches);
+    $this->assertCount(2, $matches, $output);
     $this->assertDirectoryDoesNotExist($matches[1]);
 
     // Rerunning the command should exit with a message that no newer version