diff --git a/scripts/storage/secondary/cloud-install-sys-tmplt b/scripts/storage/secondary/cloud-install-sys-tmplt
index ad976c502c69..fc09dc968fff 100755
--- a/scripts/storage/secondary/cloud-install-sys-tmplt
+++ b/scripts/storage/secondary/cloud-install-sys-tmplt
@@ -44,6 +44,7 @@ failed() {
 }
 
 #set -x
+umask 0022 # ensure we have the proper permissions even on hardened deployments
 mflag=
 fflag=
 ext="vhd"
diff --git a/scripts/storage/secondary/setup-sysvm-tmplt b/scripts/storage/secondary/setup-sysvm-tmplt
index 06f0586fe342..63006cc4e4c2 100755
--- a/scripts/storage/secondary/setup-sysvm-tmplt
+++ b/scripts/storage/secondary/setup-sysvm-tmplt
@@ -19,6 +19,7 @@
 
 # Usage: e.g. failed $? "this is an error"
 set -x
+umask 0022 # ensure we have the proper permissions even on hardened deployments
 
 failed() {
   local returnval=$1