diff --git a/bootstrap/bootstrap.py b/bootstrap/bootstrap.py
index 7334fec..41bb009 100644
--- a/bootstrap/bootstrap.py
+++ b/bootstrap/bootstrap.py
@@ -76,6 +76,13 @@ def install_miniconda(installer_path, prefix):
         '-u', '-b',
         '-p', prefix
     ], stderr=subprocess.STDOUT)
+    # fix permissions on initial install
+    # a few files have the wrong ownership and permissions initially
+    # when the installer is run as root
+    subprocess.check_call(
+        ["chown", "-R", "{}:{}".format(os.getuid(), os.getgid()), prefix]
+    )
+    subprocess.check_call(["chmod", "-R", "o-w", prefix])
 
 
 def pip_install(prefix, packages, editable=False):
diff --git a/tljh/installer.py b/tljh/installer.py
index 15ab952..1618908 100644
--- a/tljh/installer.py
+++ b/tljh/installer.py
@@ -1,15 +1,16 @@
-import sys
+import argparse
 import os
-import tljh.systemd as systemd
-import tljh.conda as conda
+import secrets
+import subprocess
+import sys
+import time
 from urllib.error import HTTPError
 from urllib.request import urlopen, URLError
-from tljh import user
-import secrets
-import argparse
-import time
+
 from ruamel.yaml import YAML
 
+from tljh import conda, systemd, user
+
 INSTALL_PREFIX = os.environ.get('TLJH_INSTALL_PREFIX', '/opt/tljh')
 HUB_ENV_PREFIX = os.path.join(INSTALL_PREFIX, 'hub')
 USER_ENV_PREFIX = os.path.join(INSTALL_PREFIX, 'user')
@@ -193,6 +194,9 @@ def main():
 
     ensure_usergroups()
     ensure_user_environment(args.user_requirements_txt_url)
+    # Weird setuptools issue creates a few world-writable metadata files.
+    # Fix it:
+    subprocess.check_call(["chmod", "-R", "o-w", os.path.join(HUB_ENV_PREFIX, "pkgs")])
 
     print("Setting up JupyterHub...")
     ensure_jupyterhub_package(HUB_ENV_PREFIX)