diff --git a/cookbook b/cookbook
index 6f49579..974ea65 160000
--- a/cookbook
+++ b/cookbook
@@ -1 +1 @@
-Subproject commit 6f4957952d48e69f52d06a0519061bd75df99f79
+Subproject commit 974ea6514edcbf186ecb335b6505bf6edc2da58b
diff --git a/mk/filesystem.mk b/mk/filesystem.mk
index fa9d437..e72cde1 100644
--- a/mk/filesystem.mk
+++ b/mk/filesystem.mk
@@ -26,6 +26,7 @@ build/filesystem.bin: filesystem.toml build/bootloader build/kernel prefix
 	chmod +s build/filesystem/bin/passwd
 	chmod +s build/filesystem/bin/su
 	chmod +s build/filesystem/bin/sudo
+	chmod og-rwx build/filesystem/etc/shadow
 	mkdir build/filesystem/tmp
 	chmod 1777 build/filesystem/tmp
 	sync