diff --git a/grub.macros b/grub.macros
index 44c6886..69110db 100644
--- a/grub.macros
+++ b/grub.macros
@@ -474,10 +474,10 @@ touch ${RPM_BUILD_ROOT}/boot/%{name}/grub.cfg			\
 %{expand:%%files %{1}}						\
 %defattr(-,root,root,-)						\
 %config(noreplace) %{_sysconfdir}/%{name}-efi.cfg		\
-%dir %attr(0755,root,root)/boot/efi/EFI/%{efidir}		\
-/boot/efi/EFI/%{efidir}/%{2}					\
+%dir %attr(0700,root,root)/boot/efi/EFI/%{efidir}		\
+%attr(0700,root,root)/boot/efi/EFI/%{efidir}/%{2}		\
 %attr(0755,root,root)/boot/efi/EFI/%{efidir}/fonts		\
-%ghost %config(noreplace) /boot/efi/EFI/%{efidir}/grub.cfg	\
+%ghost %config(noreplace) %attr(0700,root,root)/boot/efi/EFI/%{efidir}/grub.cfg	\
 /boot/grub2/grubenv						\
 %ghost %config(noreplace) %attr(0700,root,root)/boot/efi/EFI/%{efidir}/grubenv \
 								\
@@ -489,6 +489,6 @@ touch ${RPM_BUILD_ROOT}/boot/%{name}/grub.cfg			\
 								\
 %{expand:%%files %{1}-cdboot}					\
 %defattr(-,root,root,-)						\
-%attr(0755,root,root)/boot/efi/EFI/%{efidir}/%{3}		\
-%attr(0755,root,root)/boot/efi/EFI/%{efidir}/fonts		\
+%attr(0700,root,root)/boot/efi/EFI/%{efidir}/%{3}		\
+%attr(0700,root,root)/boot/efi/EFI/%{efidir}/fonts		\
 %{nil}
diff --git a/grub2.spec b/grub2.spec
index 35d34da..0232729 100644
--- a/grub2.spec
+++ b/grub2.spec
@@ -314,7 +314,7 @@ fi
 %exclude /boot/%{name}/themes/system/*
 %attr(0700,root,root) %dir /boot/grub2
 %exclude /boot/grub2/*
-%dir %attr(0755,root,root) /boot/efi/EFI/%{efidir}
+%dir %attr(0700,root,root) /boot/efi/EFI/%{efidir}
 %exclude /boot/efi/EFI/%{efidir}/*
 %license COPYING
 %ghost %config(noreplace) /boot/grub2/grubenv
@@ -454,6 +454,10 @@ fi
 %endif
 
 %changelog
+* Thu Jan 18 2018 Peter Jones <pjones@redhat.com> - 2.02-20
+- Make everything under /boot/efi be mode 0700, since that's what FAT will
+  show anyway.
+
 * Wed Jan 17 2018 Peter Jones <pjones@redhat.com> - 2.02-20
 - Update to newer upstream for F28
 - Pull in patches for Apollo Lake hardware