diff --git a/stages/org.osbuild.chmod b/stages/org.osbuild.chmod
new file mode 100755
index 00000000..72c529be
--- /dev/null
+++ b/stages/org.osbuild.chmod
@@ -0,0 +1,67 @@
+#!/usr/bin/python3
+"""
+Change file mode bits
+
+Change the file mode bits of one or more files or directories inside the tree.
+"""
+
+import os
+import subprocess
+import sys
+
+import osbuild.api
+from osbuild.util.path import in_tree
+
+SCHEMA = r"""
+"additionalProperties": false,
+"properties": {
+  "items": {
+    "type": "object",
+    "additionalProperties": false,
+    "patternProperties": {
+      "^\\/(?!\\.\\.)((?!\\/\\.\\.\\/).)+$": {
+        "type": "object",
+        "required": ["mode"],
+        "properties": {
+          "mode": {
+            "type": "string",
+            "description": "Symbolic or numeric octal mode"
+          },
+          "recursive": {
+            "type": "boolean",
+            "description": "Change modes recursively",
+            "default": false
+          }
+        }
+      }
+    }
+  }
+}
+"""
+
+
+def chmod(path: str, mode: str, recursive: bool):
+    arguments = [mode]
+    if recursive:
+        arguments.append("--recursive")
+    arguments.append("--")
+    arguments.append(path)
+
+    subprocess.run(["chmod", *arguments], check=True)
+
+
+def main(tree, options):
+    for path, cmdargs in options["items"].items():
+        mode = cmdargs["mode"]
+        recursive = cmdargs.get("recursive", False)
+        realpath = os.path.join(tree, path.lstrip("/"))
+        if not in_tree(realpath, tree, must_exist=True):
+            raise ValueError(f"path {path} not in tree")
+        chmod(realpath, mode, recursive)
+
+    return 0
+
+
+if __name__ == "__main__":
+    args = osbuild.api.arguments()
+    sys.exit(main(args["tree"], args["options"]))