diff --git a/internal/backend/local/local.go b/internal/backend/local/local.go
index 675c4a08d..34ac3a20e 100644
--- a/internal/backend/local/local.go
+++ b/internal/backend/local/local.go
@@ -130,9 +130,10 @@ func (b *Local) Save(ctx context.Context, h restic.Handle, rd restic.RewindReade
 		return errors.Wrap(err, "Close")
 	}
 
+	// try to mark file as read-only to avoid accidential modifications
 	// ignore if the operation fails as some filesystems don't allow the chmod call
 	// e.g. exfat and network file systems with certain mount options
-	err = setNewFileMode(filename, backend.Modes.File)
+	err = setFileReadonly(filename, backend.Modes.File)
 	if err != nil && !os.IsPermission(err) {
 		return errors.Wrap(err, "Chmod")
 	}
diff --git a/internal/backend/local/local_unix.go b/internal/backend/local/local_unix.go
index 74fb47bf4..cc99d4a0b 100644
--- a/internal/backend/local/local_unix.go
+++ b/internal/backend/local/local_unix.go
@@ -9,6 +9,6 @@ import (
 )
 
 // set file to readonly
-func setNewFileMode(f string, mode os.FileMode) error {
-	return fs.Chmod(f, mode)
+func setFileReadonly(f string, mode os.FileMode) error {
+	return fs.Chmod(f, mode&^0222)
 }
diff --git a/internal/backend/local/local_windows.go b/internal/backend/local/local_windows.go
index be8f62d96..ccf788072 100644
--- a/internal/backend/local/local_windows.go
+++ b/internal/backend/local/local_windows.go
@@ -7,6 +7,6 @@ import (
 // We don't modify read-only on windows,
 // since it will make us unable to delete the file,
 // and this isn't common practice on this platform.
-func setNewFileMode(f string, mode os.FileMode) error {
+func setFileReadonly(f string, mode os.FileMode) error {
 	return nil
 }