diff --git a/gnu/services.scm b/gnu/services.scm
index 1655218f2d..b79436d3f3 100644
--- a/gnu/services.scm
+++ b/gnu/services.scm
@@ -617,6 +617,10 @@ (define actions
                       (use-modules (gnu build activation)
                                    (guix build utils))
 
+                      ;; Set the correct umask so files are created with the
+                      ;; expected permissions.
+                      (umask #o022)
+
                       ;; Make sure the user accounting database exists.  If it
                       ;; does not exist, 'setutxent' does not create it and
                       ;; thus there is no accounting at all.