diff --git a/libexec/portzap/git-changed-files b/libexec/portzap/git-changed-files
index d434047..553b8c0 100644
--- a/libexec/portzap/git-changed-files
+++ b/libexec/portzap/git-changed-files
@@ -6,12 +6,12 @@ localbase=${LOCALBASE:-/usr/local}
 git="${localbase}"/bin/git
 gitdir=$1
 commit=$2
+mode=u=rwX,g=rX,o=
 
 ##
 # functions
 gitexec()
 {
-    # shellcheck disable=SC2154
     doas -n -u _portzap \
          /bin/sh -c "umask ${mode}; ${git} ${1}"
 }
diff --git a/libexec/portzap/git-removed-files b/libexec/portzap/git-removed-files
index 9f52544..c2319d7 100644
--- a/libexec/portzap/git-removed-files
+++ b/libexec/portzap/git-removed-files
@@ -6,12 +6,12 @@ localbase=${LOCALBASE:-/usr/local}
 git="${localbase}"/bin/git
 gitdir=$1
 commit=$2
+mode=u=rwX,g=rX,o=
 
 ##
 # functions
 gitexec()
 {
-    # shellcheck disable=SC2154
     doas -n -u _portzap \
          /bin/sh -c "umask ${mode}; ${git} ${1}"
 }
diff --git a/libexec/portzap/git-rev b/libexec/portzap/git-rev
index 6e0a4f9..b8f4d50 100644
--- a/libexec/portzap/git-rev
+++ b/libexec/portzap/git-rev
@@ -4,12 +4,12 @@
 # variables
 git=/usr/local/bin/git
 gitdir=$1
+mode=u=rwX,g=rX,o=
 
 ##
 # functions
 gitexec()
 {
-    # shellcheck disable=SC2154
     doas -n -u _portzap \
          /bin/sh -c "umask ${mode}; ${git} ${1}"
 }