diff --git a/contrib/busybox-init/S42yggdrasil b/contrib/busybox-init/S42yggdrasil
index 862efc25..04dc791d 100755
--- a/contrib/busybox-init/S42yggdrasil
+++ b/contrib/busybox-init/S42yggdrasil
@@ -3,7 +3,7 @@
 CONFFILE="/etc/yggdrasil.conf"
 
 genconf() {
-	/usr/bin/yggdrasil -genconf > "$1"
+	(umask 037 && /usr/bin/yggdrasil -genconf > "$1")
 	return $?
 }
 
diff --git a/contrib/deb/generate.sh b/contrib/deb/generate.sh
index 5731827c..acc81a07 100644
--- a/contrib/deb/generate.sh
+++ b/contrib/deb/generate.sh
@@ -108,7 +108,7 @@ then
   chmod 640 /etc/yggdrasil/yggdrasil.conf
 else
   echo "Generating initial configuration file /etc/yggdrasil/yggdrasil.conf"
-  /usr/bin/yggdrasil -genconf > /etc/yggdrasil/yggdrasil.conf
+  (umask 037 && /usr/bin/yggdrasil -genconf > /etc/yggdrasil/yggdrasil.conf)
 
   chown root:yggdrasil /etc/yggdrasil/yggdrasil.conf
   chmod 640 /etc/yggdrasil/yggdrasil.conf
diff --git a/contrib/docker/entrypoint.sh b/contrib/docker/entrypoint.sh
index 26c685a8..5bbf0f0a 100755
--- a/contrib/docker/entrypoint.sh
+++ b/contrib/docker/entrypoint.sh
@@ -6,7 +6,7 @@ CONF_DIR="/etc/yggdrasil-network"
 
 if [ ! -f "$CONF_DIR/config.conf" ]; then
   echo "generate $CONF_DIR/config.conf"
-  yggdrasil --genconf > "$CONF_DIR/config.conf"
+  (umask 037 && yggdrasil --genconf > "$CONF_DIR/config.conf")
 fi
 
 yggdrasil --useconf < "$CONF_DIR/config.conf"
diff --git a/contrib/freebsd/yggdrasil b/contrib/freebsd/yggdrasil
index 58482fc9..10fc0509 100644
--- a/contrib/freebsd/yggdrasil
+++ b/contrib/freebsd/yggdrasil
@@ -33,7 +33,7 @@ yggdrasil_start()
 
 	test ! -f /etc/yggdrasil.conf && (
 		logger -s -t yggdrasil "Generating new configuration file into /etc/yggdrasil.conf"
-		/usr/local/bin/yggdrasil -genconf > /etc/yggdrasil.conf
+		(umask 037 && /usr/local/bin/yggdrasil -genconf > /etc/yggdrasil.conf)
 	)
 
 	tap_path="$(cat /etc/yggdrasil.conf | egrep -o '/dev/tap[0-9]{1,2}$')"
diff --git a/contrib/macos/create-pkg.sh b/contrib/macos/create-pkg.sh
index 773f01ee..9d063d65 100755
--- a/contrib/macos/create-pkg.sh
+++ b/contrib/macos/create-pkg.sh
@@ -55,7 +55,7 @@ then
   echo "Normalising /etc/yggdrasil.conf"
   /usr/local/bin/yggdrasil -useconffile /Library/Preferences/Yggdrasil/yggdrasil.conf.`date +%Y%m%d` -normaliseconf > /etc/yggdrasil.conf
 else
-  /usr/local/bin/yggdrasil -genconf > /etc/yggdrasil.conf
+  (umask 037 && /usr/local/bin/yggdrasil -genconf > /etc/yggdrasil.conf)
 fi
 
 # Unload existing Yggdrasil launchd service, if possible
diff --git a/contrib/openrc/yggdrasil b/contrib/openrc/yggdrasil
index aece8ecb..f77b2603 100755
--- a/contrib/openrc/yggdrasil
+++ b/contrib/openrc/yggdrasil
@@ -14,7 +14,7 @@ depend() {
 start_pre() {
 	if [ ! -f "${CONFFILE}" ]; then
 		ebegin "Generating new configuration file into ${CONFFILE}"
-		if ! eval ${command} -genconf > ${CONFFILE}; then
+		if ! (umask 037 && eval ${command} -genconf > ${CONFFILE}); then
 			eerror "Failed to generate configuration file"
 			exit 1
 		fi
diff --git a/contrib/systemd/yggdrasil-default-config.service b/contrib/systemd/yggdrasil-default-config.service
index e9fe45be..37842f43 100644
--- a/contrib/systemd/yggdrasil-default-config.service
+++ b/contrib/systemd/yggdrasil-default-config.service
@@ -8,6 +8,7 @@ After=local-fs.target
 [Service]
 Type=oneshot
 Group=yggdrasil
+UMask=037
 StandardOutput=file:/etc/yggdrasil.conf
 ExecStart=/usr/bin/yggdrasil -genconf
 ExecStartPost=/usr/bin/chmod 0640 /etc/yggdrasil.conf
diff --git a/contrib/systemd/yggdrasil-default-config.service.debian b/contrib/systemd/yggdrasil-default-config.service.debian
index dc3fdc5a..0ed7c2e5 100644
--- a/contrib/systemd/yggdrasil-default-config.service.debian
+++ b/contrib/systemd/yggdrasil-default-config.service.debian
@@ -8,6 +8,7 @@ After=local-fs.target
 [Service]
 Type=oneshot
 Group=yggdrasil
+UMask=037
 ExecStartPre=/usr/bin/mkdir -p /etc/yggdrasil
 ExecStart=/usr/bin/yggdrasil -genconf > /etc/yggdrasil/yggdrasil.conf
 ExecStartPost=/usr/bin/chmod -R 0640 /etc/yggdrasil