diff --git a/etc/kayobe/inventory/group_vars/cis-hardening/cis b/etc/kayobe/inventory/group_vars/cis-hardening/cis
index 37d01492b..2c103cb34 100644
--- a/etc/kayobe/inventory/group_vars/cis-hardening/cis
+++ b/etc/kayobe/inventory/group_vars/cis-hardening/cis
@@ -51,6 +51,9 @@ rhel9cis_rule_6_1_15: false
 # filesystem.  We do not want to change /var/lib/docker permissions.
 rhel9cis_no_world_write_adjust: false
 
+# Prevent hardening from recursivley changing permissions on log files
+rhel9cis_rule_4_2_3: false
+
 # Configure log rotation to prevent audit logs from filling the disk
 rhel9cis_auditd:
   space_left_action: syslog
@@ -153,6 +156,9 @@ ubtu22cis_no_owner_adjust: false
 ubtu22cis_no_world_write_adjust: false
 ubtu22cis_suid_adjust: false
 
+# Prevent hardening from recursivley changing permissions on log files
+ubtu22cis_rule_4_2_3: false
+
 # Configure log rotation to prevent audit logs from filling the disk
 ubtu22cis_auditd:
   action_mail_acct: root
diff --git a/releasenotes/notes/cis-hardening-no-longer-sets-permissions-on-logs-81a48ab8ed2d6b5f.yaml b/releasenotes/notes/cis-hardening-no-longer-sets-permissions-on-logs-81a48ab8ed2d6b5f.yaml
new file mode 100644
index 000000000..e50b5b62b
--- /dev/null
+++ b/releasenotes/notes/cis-hardening-no-longer-sets-permissions-on-logs-81a48ab8ed2d6b5f.yaml
@@ -0,0 +1,8 @@
+---
+fixes:
+  - |
+    The CIS hardening scripts no longer change permissions of log files by
+    default. It is preferred to configure these permissions at source i.e on
+    whatever is creating the files. It also suffered from a time-of-check to
+    time-of-use race condition. If you want the old behaviour you can change
+    ``rhel9cis_rule_4_2_3`` and/or ``ubtu22cis_rule_4_2_3`` to ``true``.