diff --git a/libexec/sourcezap/commands/sourcezap-install b/libexec/sourcezap/commands/sourcezap-install
index 15628e7..431cdc9 100755
--- a/libexec/sourcezap/commands/sourcezap-install
+++ b/libexec/sourcezap/commands/sourcezap-install
@@ -6,6 +6,7 @@ set -e
 localbase=${LOCALBASE:-$(realpath "$(dirname "$0")"/../../..)}
 libexec="${localbase}"/libexec/sourcezap
 git="${libexec}"/utils/git/run
+mask=$("${libexec}"/utils/get-umask)
 gitdir=$1
 installdir=$2
 revfile=$3
@@ -33,7 +34,7 @@ if [ -e "${revfile}" ]; then
 else
     ##
     # install from scratch
-    umask u=rwX,g=rX,o=
+    umask "${mask}"
     "${libexec}"/utils/install/run -d "${installdir}"
     find -s . \
          -maxdepth 1 \
diff --git a/libexec/sourcezap/utils/get-umask b/libexec/sourcezap/utils/get-umask
new file mode 100644
index 0000000..c7ac963
--- /dev/null
+++ b/libexec/sourcezap/utils/get-umask
@@ -0,0 +1,6 @@
+#!/bin/sh
+set -e
+
+##
+# main
+echo "u=rwX,g=rX,o="
diff --git a/libexec/sourcezap/utils/git/run b/libexec/sourcezap/utils/git/run
index d362328..6770e9f 100755
--- a/libexec/sourcezap/utils/git/run
+++ b/libexec/sourcezap/utils/git/run
@@ -3,11 +3,13 @@ set -e
 
 ##
 # variables
+localbase=${LOCALBASE:-$(realpath "$(dirname "$0")"/../../../..)}
+libexec="${localbase}"/libexec/sourcezap
 git=$(which git)
-mode=u=rwX,g=rX,o=
+mask=$("${libexec}"/utils/get-umask)
 
 ##
 # main
 doas -n \
      -u _sourcezap \
-     /bin/sh -c "umask ${mode}; ${git} ${*}"
+     /bin/sh -c "umask ${mask}; ${git} ${*}"
diff --git a/libexec/sourcezap/utils/install/run b/libexec/sourcezap/utils/install/run
index 215d34c..3c9680e 100755
--- a/libexec/sourcezap/utils/install/run
+++ b/libexec/sourcezap/utils/install/run
@@ -3,12 +3,14 @@ set -e
 
 ##
 # variables
-mode=u=rwX,g=rX,o=
+localbase=${LOCALBASE:-$(realpath "$(dirname "$0")"/../../../..)}
+libexec="${localbase}"/libexec/sourcezap
+mask=$("${libexec}"/utils/get-umask)
 
 ##
 # main
 install -o root \
         -g _sourcezap \
-        -m "${mode}" \
+        -m "${mask}" \
         -v \
         "${@}"
diff --git a/share/sourcezap/CHANGELOG b/share/sourcezap/CHANGELOG
index 77aa9f2..4dee0cf 100644
--- a/share/sourcezap/CHANGELOG
+++ b/share/sourcezap/CHANGELOG
@@ -1,5 +1,9 @@
 * vNEXT
 
+** Add 'libexec/sourcezap/utils/get-umask'
+Add a single source of truth for the mask given to umask
+by git and sourcezap-install
+
 ** Break up 'sourcezap-install' into multiple files
 'libexec/sourcezap/utils/install/' contains files that cover both
 a fresh install and applying an update