diff --git a/rootfs.py b/rootfs.py
index a6e2419f..c31d5a18 100755
--- a/rootfs.py
+++ b/rootfs.py
@@ -159,6 +159,9 @@ def main():
     else:
         args.swap = 0
 
+    # Set constant umask
+    os.umask(0o022)
+
     # bootstrap.cfg
     try:
         os.remove(os.path.join('steps', 'bootstrap.cfg'))
diff --git a/steps/helpers.sh b/steps/helpers.sh
index bcff41de..8a89c299 100755
--- a/steps/helpers.sh
+++ b/steps/helpers.sh
@@ -7,6 +7,9 @@
 #
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+# Set constant umask
+umask 022
+
 # Get a list of files
 get_files() {
     echo "."