diff --git a/server-tools/hololake-code-channel/jd-candidate/hlcc-bootstrap.py b/server-tools/hololake-code-channel/jd-candidate/hlcc-bootstrap.py
index 9d21c98..35bcf9b 100644
--- a/server-tools/hololake-code-channel/jd-candidate/hlcc-bootstrap.py
+++ b/server-tools/hololake-code-channel/jd-candidate/hlcc-bootstrap.py
@@ -492,6 +492,10 @@ def bootstrap() -> None:
         custom_target = STATE_ROOT / "data" / "custom"
         if custom_source.is_dir():
             shutil.copytree(custom_source, custom_target, dirs_exist_ok=True)
+            for installed in custom_target.rglob("*"):
+                if installed.is_symlink():
+                    raise RuntimeError("custom template symlink forbidden")
+                installed.chmod(0o700 if installed.is_dir() else 0o600)
         set_status(stage="launching")
         process = subprocess.Popen(
             [
diff --git a/server-tools/hololake-code-channel/jd-candidate/native.test.js b/server-tools/hololake-code-channel/jd-candidate/native.test.js
index 3b4a552..336722e 100644
--- a/server-tools/hololake-code-channel/jd-candidate/native.test.js
+++ b/server-tools/hololake-code-channel/jd-candidate/native.test.js
@@ -73,6 +73,8 @@ assert.match(ini, /SHOW_FOOTER_VERSION = false/);
 assert.match(ini, /\[cron\.update_checker\][\s\S]*ENABLED = false/);
 assert.match(bootstrap, /stdout=None/);
 assert.doesNotMatch(bootstrap, /hlcc\.log|log_path\.open/);
+assert.match(bootstrap, /custom template symlink forbidden/);
+assert.match(bootstrap, /installed\.chmod\(0o700 if installed\.is_dir\(\) else 0o600\)/);
 assert.match(unit, /^User=guanghu$/m);
 assert.match(unit, /^ProtectSystem=strict$/m);
 assert.match(unit, /^ReadOnlyPaths=__RELEASE_ROOT__$/m);