diff --git a/modules/system/activation/activation-script.nix b/modules/system/activation/activation-script.nix
index 924d6f680fc..f4baebd2b2b 100644
--- a/modules/system/activation/activation-script.nix
+++ b/modules/system/activation/activation-script.nix
@@ -59,9 +59,12 @@ in
 
             export PATH=/empty
             for i in ${toString path}; do
-                PATH=$PATH:$i/bin:$i/sbin;
+                PATH=$PATH:$i/bin:$i/sbin
             done
 
+            # Ensure a consistent umask.
+            umask 0022
+
             ${
               let
                 set' = mapAttrs (n: v: if builtins.isString v then noDepEntry v else v) set;