diff --git a/debian/changelog b/debian/changelog
index e552ea75..82f937aa 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+livecd-rootfs (2.107) UNRELEASED; urgency=low
+
+  * Make sure the $PREFIX.kernel-$FLAVOUR.efi.signed output is
+    world-readable.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Tue, 04 Dec 2012 16:19:41 +0000
+
 livecd-rootfs (2.106) raring; urgency=low
 
   * re-enable all slideshows on all preinstalled images, webkit should work
diff --git a/live-build/auto/build b/live-build/auto/build
index 1ee09c59..e23710af 100755
--- a/live-build/auto/build
+++ b/live-build/auto/build
@@ -337,6 +337,7 @@ for FLAVOUR in $LB_LINUX_FLAVOURS; do
 	ln "binary/$INITFS/"vmlinu?-"$KVERS" "$PREFIX.kernel-$FLAVOUR"
 	if [ -e "binary/$INITFS/"vmlinu?-"$KVERS.efi.signed" ]; then
 		ln "binary/$INITFS/"vmlinu?-"$KVERS.efi.signed" "$PREFIX.kernel-$FLAVOUR.efi.signed"
+		chmod 644 "$PREFIX.kernel-$FLAVOUR.efi.signed"
 	fi
 	chmod 644 "$PREFIX.kernel-$FLAVOUR"
 	if [ -e "binary/$INITFS/initrd.img-$KVERS" ]; then