diff --git a/degesch.c b/degesch.c
index c509d96..7d01ef9 100644
--- a/degesch.c
+++ b/degesch.c
@@ -11251,7 +11251,10 @@ display_full_log (struct app_context *ctx)
 static bool
 dump_input_to_file (struct app_context *ctx, char *template, struct error **e)
 {
+	mode_t mask = umask (S_IXUSR | S_IRWXG | S_IRWXO);
 	int fd = mkstemp (template);
+	(void) umask (mask);
+
 	if (fd < 0)
 		FAIL ("%s", strerror (errno));