diff --git a/kas/libcmds.py b/kas/libcmds.py
index 3f29412b..b64d186a 100644
--- a/kas/libcmds.py
+++ b/kas/libcmds.py
@@ -247,9 +247,11 @@ def _setup_gitconfig(self):
             config.write()
 
     def execute(self, ctx):
+        def_umask = os.umask(0o077)
         self._setup_netrc()
         self._setup_gitconfig()
         self._setup_aws_creds()
+        os.umask(def_umask)
 
         ctx.environ['HOME'] = self.tmpdirname