diff --git a/actions/bepasty b/actions/bepasty
index f6bc5eb46..b8bf179a0 100755
--- a/actions/bepasty
+++ b/actions/bepasty
@@ -148,7 +148,7 @@ def subcommand_setup(arguments):
                 passwords[1]: 'editor',
                 passwords[2]: 'viewer',
             },
-            'DEFAULT_PERMISSIONS': '',
+            'DEFAULT_PERMISSIONS': 'read',
         }
         conf_file_write(conf)
         CONF_FILE.chmod(0o640)
diff --git a/plinth/modules/bepasty/__init__.py b/plinth/modules/bepasty/__init__.py
index 597d87513..0fa082e8c 100644
--- a/plinth/modules/bepasty/__init__.py
+++ b/plinth/modules/bepasty/__init__.py
@@ -15,7 +15,7 @@ from plinth.modules.firewall.components import Firewall
 
 from .manifest import backup, clients  # noqa, pylint: disable=unused-import
 
-version = 1
+version = 2
 
 managed_packages = ['bepasty', 'uwsgi', 'uwsgi-plugin-python3']
 
@@ -98,6 +98,9 @@ def setup(helper, old_version=None):
     helper.call('post', actions.superuser_run, 'bepasty',
                 ['setup', '--domain-name', 'freedombox.local'])
     helper.call('post', app.enable)
+    if old_version == 1 and not get_configuration().get('DEFAULT_PERMISSIONS'):
+        # Upgrade to a better default only if user hasn't changed the value.
+        set_default_permissions('read')
 
 
 def get_configuration():