Its better to remove the default executable bit put by install when no -m is provided and leave the systemd service files only readable.