diff --git a/docs/operator-manual/upgrading/2.7-2.8.md b/docs/operator-manual/upgrading/2.7-2.8.md
index 12622642d5eff..8ee91cdf984c6 100644
--- a/docs/operator-manual/upgrading/2.7-2.8.md
+++ b/docs/operator-manual/upgrading/2.7-2.8.md
@@ -65,3 +65,8 @@ p, role:action-runner, applications, action/argoproj.io/WorkflowTemplate/create-
 p, role:action-runner, applications, action/argoproj.io/CronWorkflow/create-workflow, *, allow
 p, role:action-runner, applications, action/batch/CronJob/create-job, *, allow
 ```
+
+## Change default file open mode
+
+In version 2.7, the CMP plugin was changed to open Git/Helm files with all executable bits set (unless `preserveFileMode` was specified).  
+Version 2.8 removes the executable bits in cases where they are not necessary.
diff --git a/util/io/files/tar.go b/util/io/files/tar.go
index 91b743e0c4704..13973f732fe72 100644
--- a/util/io/files/tar.go
+++ b/util/io/files/tar.go
@@ -90,13 +90,12 @@ func Untgz(dstPath string, r io.Reader, maxSize int64, preserveFileMode bool) er
 			return fmt.Errorf("illegal filepath in archive: %s", target)
 		}
 
-		var mode os.FileMode = 0755
-		if preserveFileMode {
-			mode = os.FileMode(header.Mode)
-		}
-
 		switch header.Typeflag {
 		case tar.TypeDir:
+			var mode os.FileMode = 0755
+			if preserveFileMode {
+				mode = os.FileMode(header.Mode)
+			}
 			err := os.MkdirAll(target, mode)
 			if err != nil {
 				return fmt.Errorf("error creating nested folders: %w", err)
@@ -118,6 +117,11 @@ func Untgz(dstPath string, r io.Reader, maxSize int64, preserveFileMode bool) er
 				return fmt.Errorf("error creating symlink: %s", err)
 			}
 		case tar.TypeReg:
+			var mode os.FileMode = 0644
+			if preserveFileMode {
+				mode = os.FileMode(header.Mode)
+			}
+
 			err := os.MkdirAll(filepath.Dir(target), 0755)
 			if err != nil {
 				return fmt.Errorf("error creating nested folders: %w", err)
diff --git a/util/io/files/tar_test.go b/util/io/files/tar_test.go
index 7c08246c72962..1817fa5ce9353 100644
--- a/util/io/files/tar_test.go
+++ b/util/io/files/tar_test.go
@@ -216,7 +216,7 @@ func TestUntgz(t *testing.T) {
 
 		scriptFileInfo, err := os.Stat(path.Join(destDir, "script.sh"))
 		require.NoError(t, err)
-		assert.Equal(t, os.FileMode(0755), scriptFileInfo.Mode())
+		assert.Equal(t, os.FileMode(0644), scriptFileInfo.Mode())
 	})
 }