diff --git a/changelog/bugfixes/2026-10-26-ssh-perms.md b/changelog/bugfixes/2026-10-26-ssh-perms.md
new file mode 100644
index 00000000000..0e643ced3e7
--- /dev/null
+++ b/changelog/bugfixes/2026-10-26-ssh-perms.md
@@ -0,0 +1 @@
+- Alpha and Beta only: Fixed SSH client that was broken by a configuration file with bad permissions being unreadable. ([scripts#4338](https://github.com/flatcar/scripts/pull/4338))
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/openssh b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/openssh
index 3125f149361..8eb125d09fb 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/openssh
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/openssh
@@ -10,6 +10,7 @@ cros_post_src_install_flatcar_modifications() {
     vendorize_pam_files
 
     if [[ $(flatcar_target) != 'sdk' ]] ; then
+        insopts -m 0644
         dosym -r /usr/share/flatcar/etc/ssh/ssh_config.d/50-flatcar-ssh.conf /usr/share/ssh/ssh_config
         insinto /usr/share/flatcar/etc/ssh/ssh_config.d/
         newins - 50-flatcar-ssh.conf
@@ -18,6 +19,7 @@ cros_post_src_install_flatcar_modifications() {
 # Use defaults for ssh client system-wide configuration.
 EOF
 
+        insopts -m 0600
         dosym -r /usr/share/flatcar/etc/ssh/sshd_config.d/50-flatcar-sshd.conf /usr/share/ssh/sshd_config
         insinto /usr/share/flatcar/etc/ssh/sshd_config.d/
         newins - 50-flatcar-sshd.conf
@@ -46,18 +48,16 @@ PrintMotd no
 HostkeyAlgorithms +ssh-rsa
 PubkeyAcceptedAlgorithms +ssh-rsa
 EOF
+
         # Install our socket drop-in file that disables the rate
         # limiting on the sshd socket.
-        (
-            insopts -m 0644
-            unit_dir=$(systemd_get_systemunitdir)
-            insinto "${unit_dir}/sshd.socket.d"
-            newins - no-trigger-limit-burst.conf <<'EOF'
+        insopts -m 0644
+        insinto "$(systemd_get_systemunitdir)/sshd.socket.d"
+        newins - no-trigger-limit-burst.conf <<'EOF'
 [Socket]
 TriggerLimitBurst=0
 EOF
-            # Enable some sockets that aren't enabled by their own ebuilds.
-            systemd_enable_service sockets.target sshd.socket
-        )
+        # Enable some sockets that aren't enabled by their own ebuilds.
+        systemd_enable_service sockets.target sshd.socket
     fi
 }
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/profile.bashrc b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/profile.bashrc
index 72701a012f9..3f0583dbc53 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/profile.bashrc
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/profile.bashrc
@@ -93,6 +93,14 @@ cros_stack_hooks() {
 			einfo "Running stacked hooks for ${phase}"
 			header=false
 		fi
+
+		# Don't allow *into or *opts helper values to leak between ebuilds and
+		# hook functions. They normally leak between ebuild phases, but leaking
+		# them to and from other scripts maintained by other people is
+		# hazardous. These default values come from Portage's phase-helpers.sh.
+		local -x __E_DESTTREE="/usr" __E_INSDESTTREE= __E_EXEDESTTREE= __E_DOCDESTTREE=
+		local -x INSOPTIONS="-m0644" EXEOPTIONS="-m0755" LIBOPTIONS="-m0644" DIROPTIONS="-m0755"
+
 		ebegin "   ${func#cros_${phase}_}"
 		${func}
 		eend $?