diff --git a/nixos/modules/virtualisation/nixos-container.pl b/nixos/modules/virtualisation/nixos-container.pl
index c60662d8d399..718630fe8b9b 100644
--- a/nixos/modules/virtualisation/nixos-container.pl
+++ b/nixos/modules/virtualisation/nixos-container.pl
@@ -9,6 +9,9 @@ use Getopt::Long qw(:config gnu_getopt);
 
 my $socat = '@socat@/bin/socat';
 
+# Ensure a consistent umask.
+umask 0022;
+
 # Parse the command line.
 
 sub showHelp {