diff --git a/server-tools/lake-lamp-authz/hooks/guanghu-ice-heart-post-receive b/server-tools/lake-lamp-authz/hooks/guanghu-ice-heart-post-receive
index f3bf8d1..9c0aeb8 100755
--- a/server-tools/lake-lamp-authz/hooks/guanghu-ice-heart-post-receive
+++ b/server-tools/lake-lamp-authz/hooks/guanghu-ice-heart-post-receive
@@ -12,8 +12,11 @@ cd "$repo_dir"
 owner_uid=$(id -u)
 
 share_tree() {
-  find "$1" -user "$owner_uid" -type d -exec chmod g+rwx {} +
-  find "$1" -user "$owner_uid" -type f -exec chmod g+rw {} +
+  # RestrictSUIDSGID forbids chmod calls that preserve a setgid directory.
+  # Existing shared directories are already traversable, so touch only new
+  # private directories and use a numeric mode that drops the special bit.
+  find "$1" -user "$owner_uid" -type d ! -perm -g=x -exec chmod 0770 {} +
+  find "$1" -user "$owner_uid" -type f ! -perm -g=r -exec chmod g+r {} +
 }
 
 share_tree "$repo_dir/objects"