diff --git a/etc/grml/fai/config/hooks/updatebase.GRMLBASE b/etc/grml/fai/config/hooks/updatebase.GRMLBASE
index b8204c279..43ee0cfda 100755
--- a/etc/grml/fai/config/hooks/updatebase.GRMLBASE
+++ b/etc/grml/fai/config/hooks/updatebase.GRMLBASE
@@ -71,7 +71,7 @@ if ! [ -e "${target}"/etc/udev/kernel-upgrade ] ; then
 fi
 
 # install all apt related files
-fcopy -i -B -v -r /etc/apt
+fcopy -M -i -B -v -r /etc/apt
 
 # install packages from a repository of a specific date
 if [ -n "${WAYBACK_DATE:-}" ] ; then
diff --git a/etc/grml/fai/config/scripts/GRMLBASE/20-sudo b/etc/grml/fai/config/scripts/GRMLBASE/20-sudo
index 240041c99..9e1cb65a9 100755
--- a/etc/grml/fai/config/scripts/GRMLBASE/20-sudo
+++ b/etc/grml/fai/config/scripts/GRMLBASE/20-sudo
@@ -15,7 +15,7 @@ target=${target:?}
 # shellcheck source=/dev/null
 . "$GRML_LIVE_CONFIG"
 
-fcopy -v /etc/sudoers
+fcopy -m root,root,0440 -v /etc/sudoers
 sed -i "s/\$USERNAME/$USERNAME/" "$target"/etc/sudoers
 chmod 440 "$target"/etc/sudoers
 chown 0:0 "$target"/etc/sudoers
diff --git a/etc/grml/fai/config/scripts/GRMLBASE/25-locales b/etc/grml/fai/config/scripts/GRMLBASE/25-locales
index d45836666..ca3c08674 100755
--- a/etc/grml/fai/config/scripts/GRMLBASE/25-locales
+++ b/etc/grml/fai/config/scripts/GRMLBASE/25-locales
@@ -14,10 +14,10 @@ target=${target:?}
 
 # set up /etc/locale.gen, GRMLBASE installs a minimal configuration.
 # Only if the LOCALES class is added you get a fuller set of locales.
-fcopy -v /etc/locale.gen
+fcopy -M -v /etc/locale.gen
 
 # set up /etc/locale.conf, to avoid systemd-firstboot prompting for user input
-fcopy -v /etc/locale.conf
+fcopy -M -v /etc/locale.conf
 
 # get rid of locales unless using class LOCALES
 set +u
diff --git a/etc/grml/fai/config/scripts/GRMLBASE/26-console-setup b/etc/grml/fai/config/scripts/GRMLBASE/26-console-setup
index 4bf7f3c32..3ad1a2d87 100755
--- a/etc/grml/fai/config/scripts/GRMLBASE/26-console-setup
+++ b/etc/grml/fai/config/scripts/GRMLBASE/26-console-setup
@@ -9,7 +9,7 @@
 set -u
 set -e
 
-fcopy -v /etc/default/console-setup
+fcopy -M -v /etc/default/console-setup
 
 ## END OF FILE #################################################################
 # vim:ft=sh expandtab ai tw=80 tabstop=4 shiftwidth=2
diff --git a/etc/grml/fai/config/scripts/GRMLBASE/30-fstab b/etc/grml/fai/config/scripts/GRMLBASE/30-fstab
index 01e46c157..4611566c0 100755
--- a/etc/grml/fai/config/scripts/GRMLBASE/30-fstab
+++ b/etc/grml/fai/config/scripts/GRMLBASE/30-fstab
@@ -15,7 +15,7 @@ target=${target:?}
 # shellcheck source=/dev/null
 . "$GRML_LIVE_CONFIG"
 
-fcopy -v /etc/fstab
+fcopy -M -v /etc/fstab
 sed -i "s/uid=USERNAME,gid=USERNAME/uid=$USERNAME,gid=$USERNAME/" "$target"/etc/fstab
 
 ## END OF FILE #################################################################
diff --git a/etc/grml/fai/config/scripts/GRMLBASE/31-motd b/etc/grml/fai/config/scripts/GRMLBASE/31-motd
index b1ed247d1..78e9e566c 100755
--- a/etc/grml/fai/config/scripts/GRMLBASE/31-motd
+++ b/etc/grml/fai/config/scripts/GRMLBASE/31-motd
@@ -9,7 +9,7 @@
 set -u
 set -e
 
-fcopy -v /etc/motd
+fcopy -M -v /etc/motd
 
 ## END OF FILE #################################################################
 # vim:ft=sh expandtab ai tw=80 tabstop=4 shiftwidth=2
diff --git a/etc/grml/fai/config/scripts/GRMLBASE/34-hosts b/etc/grml/fai/config/scripts/GRMLBASE/34-hosts
index 37258e469..f26ec075d 100755
--- a/etc/grml/fai/config/scripts/GRMLBASE/34-hosts
+++ b/etc/grml/fai/config/scripts/GRMLBASE/34-hosts
@@ -15,7 +15,7 @@ target=${target:?}
 # shellcheck source=/dev/null
 . "$GRML_LIVE_CONFIG"
 
-fcopy -v /etc/hosts
+fcopy -M -v /etc/hosts
 
 # replace $HOSTNAME with the real hostname:
 sed -i "s/\$HOSTNAME/$HOSTNAME/" "$target"/etc/hosts
diff --git a/etc/grml/fai/config/scripts/GRMLBASE/35-network b/etc/grml/fai/config/scripts/GRMLBASE/35-network
index a87d75130..035a656e0 100755
--- a/etc/grml/fai/config/scripts/GRMLBASE/35-network
+++ b/etc/grml/fai/config/scripts/GRMLBASE/35-network
@@ -9,7 +9,7 @@
 set -u
 set -e
 
-fcopy -v /etc/network/interfaces
+fcopy -M -v /etc/network/interfaces
 
 ## END OF FILE #################################################################
 # vim:ft=sh expandtab ai tw=80 tabstop=4 shiftwidth=2
diff --git a/etc/grml/fai/config/scripts/GRMLBASE/39-modprobe b/etc/grml/fai/config/scripts/GRMLBASE/39-modprobe
index 24e038c0f..9d454c382 100755
--- a/etc/grml/fai/config/scripts/GRMLBASE/39-modprobe
+++ b/etc/grml/fai/config/scripts/GRMLBASE/39-modprobe
@@ -13,7 +13,7 @@ set -e
 target=${target:?}
 
 # Install all present modprobe.d configuration files
-fcopy -v -i -r /etc/modprobe.d
+fcopy -M -v -i -r /etc/modprobe.d
 
 if [ -f "${target}/lib/modprobe.d/50-nfs.conf" ] ; then  # nfs-kernel-server >=1:2.6.2-1
   echo "Clearing /lib/modprobe.d/50-nfs.conf to avoid automatic kmod/busybox issues"
diff --git a/etc/grml/fai/config/scripts/GRMLBASE/41-modules b/etc/grml/fai/config/scripts/GRMLBASE/41-modules
index dd90ff33f..eaba3ed3b 100755
--- a/etc/grml/fai/config/scripts/GRMLBASE/41-modules
+++ b/etc/grml/fai/config/scripts/GRMLBASE/41-modules
@@ -9,7 +9,7 @@
 set -u
 set -e
 
-fcopy -v /etc/modules
+fcopy -M -v /etc/modules
 
 ## END OF FILE #################################################################
 # vim:ft=sh expandtab ai tw=80 tabstop=4 shiftwidth=2
diff --git a/etc/grml/fai/config/scripts/GRMLBASE/42-branding b/etc/grml/fai/config/scripts/GRMLBASE/42-branding
index 66746d972..89daa8e92 100755
--- a/etc/grml/fai/config/scripts/GRMLBASE/42-branding
+++ b/etc/grml/fai/config/scripts/GRMLBASE/42-branding
@@ -9,9 +9,9 @@
 set -u
 set -e
 
-fcopy -v /usr/share/initramfs-tools/scripts/init-top/grml
-fcopy -v /usr/share/grml/desktop-bg.png
-fcopy -v /usr/share/doc/grml-docs/startpage.html
+fcopy -m root,root,0755 -v /usr/share/initramfs-tools/scripts/init-top/grml
+fcopy -M -v /usr/share/grml/desktop-bg.png
+fcopy -M -v /usr/share/doc/grml-docs/startpage.html
 
 ## END OF FILE #################################################################
 # vim:ft=sh expandtab ai tw=80 tabstop=4 shiftwidth=2
diff --git a/etc/grml/fai/config/scripts/GRMLBASE/43-rsyslog b/etc/grml/fai/config/scripts/GRMLBASE/43-rsyslog
index 9ee104396..7bf733cf3 100755
--- a/etc/grml/fai/config/scripts/GRMLBASE/43-rsyslog
+++ b/etc/grml/fai/config/scripts/GRMLBASE/43-rsyslog
@@ -9,7 +9,7 @@
 set -u
 set -e
 
-fcopy -v /etc/rsyslog.conf
+fcopy -M -v /etc/rsyslog.conf
 
 ## END OF FILE #################################################################
 # vim:ft=sh expandtab ai tw=80 tabstop=4 shiftwidth=2
diff --git a/etc/grml/fai/config/scripts/GRMLBASE/51-cloud-init b/etc/grml/fai/config/scripts/GRMLBASE/51-cloud-init
index 017408d00..0bb89e695 100755
--- a/etc/grml/fai/config/scripts/GRMLBASE/51-cloud-init
+++ b/etc/grml/fai/config/scripts/GRMLBASE/51-cloud-init
@@ -12,7 +12,7 @@ set -e
 # NOTE: this file is relevant only with cloud-init package installed,
 # though we install it unconditionally via GRMLBASE class to have it
 # available and configured as shipped by Grml ISOs
-fcopy -v /etc/cloud/cloud.cfg.d/42_grml.cfg
+fcopy -M -v /etc/cloud/cloud.cfg.d/42_grml.cfg
 
 ## END OF FILE #################################################################
 # vim:ft=sh expandtab ai tw=80 tabstop=4 shiftwidth=2
diff --git a/etc/grml/fai/config/scripts/GRMLBASE/80-initramfs b/etc/grml/fai/config/scripts/GRMLBASE/80-initramfs
index 0b3f892dc..8f235cba6 100755
--- a/etc/grml/fai/config/scripts/GRMLBASE/80-initramfs
+++ b/etc/grml/fai/config/scripts/GRMLBASE/80-initramfs
@@ -12,9 +12,9 @@ set -e
 # FAI sets $target, but shellcheck does not know that.
 target=${target:?}
 
-fcopy -v /etc/initramfs-tools/hooks/000-udev-shutup
-fcopy -v /etc/initramfs-tools/conf.d/xz-compress
-fcopy -v /etc/initramfs-tools/modules
+fcopy -m root,root,0755 -v /etc/initramfs-tools/hooks/000-udev-shutup
+fcopy -M -v /etc/initramfs-tools/conf.d/xz-compress
+fcopy -M -v /etc/initramfs-tools/modules
 
 if ! [ -f "$target"/usr/share/initramfs-tools/scripts/live ] ; then
   echo "Error: live-boot/-initramfs does not seem to be present, can not create initramfs. Exiting.">&2
diff --git a/etc/grml/fai/config/scripts/GRML_FULL/01-firefox b/etc/grml/fai/config/scripts/GRML_FULL/01-firefox
index 64dc868d1..73988b4f9 100755
--- a/etc/grml/fai/config/scripts/GRML_FULL/01-firefox
+++ b/etc/grml/fai/config/scripts/GRML_FULL/01-firefox
@@ -9,7 +9,7 @@
 set -u
 set -e
 
-fcopy -i -B -v /etc/firefox-esr/firefox-esr.js
+fcopy -M -i -B -v /etc/firefox-esr/firefox-esr.js
 
 ## END OF FILE #################################################################
 # vim:ft=sh expandtab ai tw=80 tabstop=4 shiftwidth=2