diff --git a/cookbook b/cookbook
index 6f4957952d48e69f52d06a0519061bd75df99f79..974ea6514edcbf186ecb335b6505bf6edc2da58b 160000
--- a/cookbook
+++ b/cookbook
@@ -1 +1 @@
-Subproject commit 6f4957952d48e69f52d06a0519061bd75df99f79
+Subproject commit 974ea6514edcbf186ecb335b6505bf6edc2da58b
diff --git a/mk/filesystem.mk b/mk/filesystem.mk
index fa9d4376a216f657aeade39a045ba9c994b27d55..e72cde1e7996237f63b2d4e520027b71623f556c 100644
--- a/mk/filesystem.mk
+++ b/mk/filesystem.mk
@@ -26,6 +26,7 @@ build/filesystem.bin: filesystem.toml build/bootloader build/kernel prefix
 	chmod +s build/filesystem/bin/passwd
 	chmod +s build/filesystem/bin/su
 	chmod +s build/filesystem/bin/sudo
+	chmod og-rwx build/filesystem/etc/shadow
 	mkdir build/filesystem/tmp
 	chmod 1777 build/filesystem/tmp
 	sync