diff --git a/export/CMakeLists.txt.export b/export/CMakeLists.txt.export
index 061ee962e..9fcff3a88 100644
--- a/export/CMakeLists.txt.export
+++ b/export/CMakeLists.txt.export
@@ -785,14 +785,23 @@ install(
 # install basis.h at install time so LIBINT_DATADIR_ABSOLUTE reflects
 # any --prefix override. $ENV{DESTDIR} must be prepended manually
 # here: install(CODE) runs custom code and does not get the automatic
-# DESTDIR handling that install(FILES) etc. have.
+# DESTDIR handling that install(FILES) etc. have. configure_file into the
+# build tree, then file(COPY) into the install tree with explicit
+# FILE_PERMISSIONS so the installed header does not inherit basis.h.in's
+# mode (e.g. 0600, which varies by build env); this also works with the
+# 3.16 minimum required here, unlike configure_file's NO_SOURCE_PERMISSIONS
+# (CMake 3.19+).
 install(CODE "
   set(LIBINT_VERSION \"${LIBINT_VERSION}\")
   set(LIBINT_DATADIR_ABSOLUTE \"\${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_DATADIR}/libint/${LIBINT_VERSION}\")
   configure_file(
     \"${PROJECT_SOURCE_DIR}/include/libint2/basis.h.in\"
-    \"\$ENV{DESTDIR}\${CMAKE_INSTALL_PREFIX}/${LIBINT2_INSTALL_INCLUDEDIR}/libint2/basis.h\"
+    \"${PROJECT_BINARY_DIR}/basis.h.install/basis.h\"
     @ONLY)
+  file(COPY
+    \"${PROJECT_BINARY_DIR}/basis.h.install/basis.h\"
+    DESTINATION \"\$ENV{DESTDIR}\${CMAKE_INSTALL_PREFIX}/${LIBINT2_INSTALL_INCLUDEDIR}/libint2\"
+    FILE_PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)
 ")
 
 # install bundled Boost headers if needed
diff --git a/src/lib/libint/CMakeLists.txt b/src/lib/libint/CMakeLists.txt
index c407c9eb2..00193b847 100644
--- a/src/lib/libint/CMakeLists.txt
+++ b/src/lib/libint/CMakeLists.txt
@@ -227,13 +227,22 @@ else()
         )
     endforeach()
 
-    # generate basis.h at install time so LIBINT_DATADIR_ABSOLUTE reflects any --prefix override
+    # generate basis.h at install time so LIBINT_DATADIR_ABSOLUTE reflects any --prefix override.
+    # configure_file into the build tree, then file(COPY) into the install tree with explicit
+    # FILE_PERMISSIONS: this avoids the installed header inheriting basis.h.in's mode (e.g. 0600,
+    # which varies by build env) without relying on NO_SOURCE_PERMISSIONS, and prepends
+    # $ENV{DESTDIR} manually -- install(CODE) runs custom code and does not get the automatic
+    # DESTDIR handling that install(FILES) etc. have.
     install(CODE "
       set(LIBINT_VERSION \"${LIBINT_VERSION}\")
       set(LIBINT_DATADIR_ABSOLUTE \"\${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_DATADIR}/libint/${LIBINT_VERSION}\")
       configure_file(
         \"${PROJECT_SOURCE_DIR}/include/libint2/basis.h.in\"
-        \"\${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_INCLUDEDIR}/libint2/basis.h\"
+        \"${CMAKE_CURRENT_BINARY_DIR}/basis.h.install/basis.h\"
         @ONLY)
+      file(COPY
+        \"${CMAKE_CURRENT_BINARY_DIR}/basis.h.install/basis.h\"
+        DESTINATION \"\$ENV{DESTDIR}\${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_INCLUDEDIR}/libint2\"
+        FILE_PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)
     ")
 endif()