diff --git a/build/pkg-scripts/postinstall b/build/pkg-scripts/postinstall
index c12952957d3..693de5cdd5f 100755
--- a/build/pkg-scripts/postinstall
+++ b/build/pkg-scripts/postinstall
@@ -4,6 +4,10 @@
 # Extract a referral / promo code from the installer path of the format /dir/path/Setup-Brave-Anything-xxx001.pkg
 # where the promo code would be xxx001
 installerPath=$1
+installationPath=$2
+# TODO: ugly to assume the name of the app, especially with multi-channel.
+# Luckily for now, release channel is the only channel with a pkg installer.
+installationAppPath="$installationPath/Brave.app"
 installerPathPromoCodeRegex='.+-([a-zA-Z0-9]{3}[0-9]{3})\s?(?:\([0-9]+\))?\.pkg$'
 userDataDir="$HOME/Library/Application Support/brave"
 promoCodePath="$userDataDir/promoCode"
@@ -11,7 +15,17 @@ promoCodePath="$userDataDir/promoCode"
 userName="$USER"
 echo "Installer path is: $installerPath"
 echo "Username is: $userName"
+echo "Installation app path is: $installationAppPath"
 
+# Fix the permissions on installed .app so that updater has permissions to write new version
+# by default pkg with install the .app with root:wheel owner and 'drwxr-xr-x' permission.
+# Since the app is run by the user, and the updater built-in to electron does not successfully
+# escalate to root permissions, updating will fail.
+# We'll allow all standard users of the machine permissions to run and update the app.
+sudo chmod -R 775 "$installationAppPath"
+sudo chgrp -R staff "$installationAppPath"
+
+# Detect if installer contained a referral promotion code within the filename
 if [[ $installerPath =~ $installerPathPromoCodeRegex ]]; then
   echo "Installer path matched for promo code"
   n=${#BASH_REMATCH[*]}