diff --git a/build_debian.sh b/build_debian.sh
index 13e39ac7361..9715371a1cd 100755
--- a/build_debian.sh
+++ b/build_debian.sh
@@ -726,6 +726,9 @@ if [[ $TARGET_BOOTLOADER == uboot ]]; then
     fi
 fi
 
+## Ensure the system-map readable only by root
+sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT bash -c 'chmod 0600 /boot/System.map-*'
+
 # Collect host image version files before cleanup
 SONIC_VERSION_CACHE=${SONIC_VERSION_CACHE}  \
 	DBGOPT="${DBGOPT}" \