diff --git a/ChangeLog.d/cmake-install.txt b/ChangeLog.d/cmake-install.txt
new file mode 100644
index 000000000..1bcec4aa9
--- /dev/null
+++ b/ChangeLog.d/cmake-install.txt
@@ -0,0 +1,3 @@
+Bugfix
+   * Library files installed after a CMake build no longer have execute
+     permission.
diff --git a/library/CMakeLists.txt b/library/CMakeLists.txt
index dc15ad6e0..c551ee557 100644
--- a/library/CMakeLists.txt
+++ b/library/CMakeLists.txt
@@ -201,7 +201,7 @@ foreach(target IN LISTS target_libraries)
         PRIVATE ${thirdparty_def})
     install(TARGETS ${target}
             DESTINATION ${LIB_INSTALL_DIR}
-            PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE)
+            PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)
 endforeach(target)
 
 add_custom_target(lib DEPENDS mbedcrypto mbedx509 mbedtls)