diff --git a/arch-nspawn.in b/arch-nspawn.in
index fb2b53e..8a87b96 100644
--- a/arch-nspawn.in
+++ b/arch-nspawn.in
@@ -13,6 +13,10 @@
 m4_include(lib/common.sh)
 m4_include(lib/archroot.sh)
 
+# umask might have been changed in /etc/profile
+# ensure that sane default is set again
+umask 0022
+
 working_dir=''
 
 files=()
diff --git a/archbuild.in b/archbuild.in
index 163a108..709d70d 100644
--- a/archbuild.in
+++ b/archbuild.in
@@ -59,7 +59,7 @@ if ${clean_first} || [[ ! -d "${chroots}/${repo}-${arch}" ]]; then
 	lock_close 9
 
 	rm -rf --one-file-system "${chroots}/${repo}-${arch}"
-	mkdir -p "${chroots}/${repo}-${arch}"
+	mkdir -m755 -p "${chroots}/${repo}-${arch}"
 	setarch "${arch}" mkarchroot \
 		-C "@pkgdatadir@/pacman-${repo}.conf" \
 		-M "@pkgdatadir@/makepkg-${arch}.conf" \
diff --git a/mkarchroot.in b/mkarchroot.in
index 7da19dc..6c42d3b 100644
--- a/mkarchroot.in
+++ b/mkarchroot.in
@@ -13,6 +13,10 @@
 m4_include(lib/common.sh)
 m4_include(lib/archroot.sh)
 
+# umask might have been changed in /etc/profile
+# ensure that sane default is set again
+umask 0022
+
 working_dir=''
 
 files=()