diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index 0bcb0baaab8..aaef2723da0 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -49,6 +49,13 @@ stdenv.mkDerivation rec {
     ]
     ++ optional withGssapiPatches gssapiSrc;
 
+  postPatch =
+    # On Hydra this makes installation fail (sometimes?),
+    # and nix store doesn't allow such fancy permission bits anyway.
+    ''
+      substituteInPlace Makefile.in --replace '$(INSTALL) -m 4711' '$(INSTALL) -m 0711'
+    '';
+
   buildInputs = [ zlib openssl libedit pkgconfig pam ]
     ++ optional withKerberos kerberos
     ++ optional hpnSupport autoreconfHook;