diff --git a/CHANGELOG.md b/CHANGELOG.md
index 905bd44..56145cd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 - Prevent AdroitAdorKhan-EnergizedProtection updates (current repo has a broken
   list)
+- Fix `block.list` permissions on first generation.
 
 ### Removed
 - Removed in-repo custom ad domains list
diff --git a/update.sh b/update.sh
index 1c136b9..5cb1729 100755
--- a/update.sh
+++ b/update.sh
@@ -92,6 +92,20 @@ done
 
 TEMP_BLOCKLIST=$(mktemp -p "$TEMP_DIR")
 "$WORKDIR/make-block.pl" --out="$TEMP_BLOCKLIST"
+
+# Blocklist generation succeeded, install it!
+
+if [[ ! -e $BLOCKLIST ]]; then
+    (
+    # First time:
+    # Create an empty blocklist with -rw-r--r-- permissions.
+    # Prevents file not being readable; disregard permissions coming from
+    # whatever file permissions 'mktemp' sets.
+    umask 0022
+    touch -- "$BLOCKLIST"
+    )
+fi
+
 replace_with "$BLOCKLIST" "$TEMP_BLOCKLIST"
 
 if [[ ${#DNSMASQ_RESTART_COMMAND[@]} -gt 0 ]]; then