diff --git a/lib/cdist/exec/remote.py b/lib/cdist/exec/remote.py
index 11b8c78e..173d1984 100644
--- a/lib/cdist/exec/remote.py
+++ b/lib/cdist/exec/remote.py
@@ -105,6 +105,9 @@ class Remote(object):
         cmd = self._exec.split()
         cmd.append(self.target_host)
 
+        # Always call umask before actual call to ensure proper file permissions
+        cmd.append("umask 077;")
+
         # can't pass environment to remote side, so prepend command with
         # variable declarations
         if env: