diff --git a/tools/tools/nanobsd/defaults.sh b/tools/tools/nanobsd/defaults.sh
index fdb236000ff..067d306689a 100755
--- a/tools/tools/nanobsd/defaults.sh
+++ b/tools/tools/nanobsd/defaults.sh
@@ -490,7 +490,9 @@ setup_nanobsd_etc ( ) (
 	touch etc/diskless
 
 	# Make root filesystem R/O by default
+	[ ! -z "${NANO_NOPRIV_BUILD}" ] && chmod 666 etc/defaults/rc.conf
 	echo "root_rw_mount=NO" >> etc/defaults/rc.conf
+	[ ! -z "${NANO_NOPRIV_BUILD}" ] && chmod 444 etc/defaults/rc.conf
 
 	# save config file for scripts
 	echo "NANO_DRIVE=${NANO_DRIVE}" > etc/nanobsd.conf
@@ -961,7 +963,7 @@ set_defaults_and_export ( ) {
 	[ ! -d "${NANO_TOOLS}" ] && [ -d "${NANO_SRC}/${NANO_TOOLS}" ] && \
 		NANO_TOOLS="${NANO_SRC}/${NANO_TOOLS}" || true
 
-	[ ! -z "${NANO_NOPRIV_BUILD}" ] && [ -z "${NANO_METALOG}"] && \
+	[ ! -z "${NANO_NOPRIV_BUILD}" ] && [ -z "${NANO_METALOG}" ] && \
 		NANO_METALOG=${NANO_OBJ}/_.metalog || true
 
 	NANO_STARTTIME=`date +%s`
diff --git a/tools/tools/nanobsd/embedded/common b/tools/tools/nanobsd/embedded/common
index 2d884561461..a4635f04570 100644
--- a/tools/tools/nanobsd/embedded/common
+++ b/tools/tools/nanobsd/embedded/common
@@ -357,7 +357,7 @@ create_diskimage ( ) (
 		# s1 is cfg, s2 is /, not sure how to make that
 		# boot (marked as active) with mkimg yet
 		mkimg -s mbr -p ${s1}:=${NANO_OBJ}/_.s1 \
-			-p ${s2}:=${NANO_OBJ}/_.s2
+			-p ${s2}:=${NANO_OBJ}/_.s2 \
 			-o ${NANO_OBJ}/_.disk.image.${NANO_NAME}
 	fi
 	) > ${NANO_OBJ}/_.di 2>&1