diff --git a/build/common.sh b/build/common.sh
index 6862ac38427..e298f627362 100755
--- a/build/common.sh
+++ b/build/common.sh
@@ -164,6 +164,9 @@ function kube::build::verify_prereqs() {
 
   kube::version::get_version_vars
   kube::version::save_version_vars "${KUBE_ROOT}/.dockerized-kube-version-defs"
+
+  # Without this, the user's umask can leak through.
+  umask 0022
 }
 
 # ---------------------------------------------------------------------------
diff --git a/hack/lib/golang.sh b/hack/lib/golang.sh
index b1e42acee5a..fa6bba14095 100755
--- a/hack/lib/golang.sh
+++ b/hack/lib/golang.sh
@@ -523,10 +523,6 @@ kube::golang::setup_env() {
 
   # This seems to matter to some tools
   export GO15VENDOREXPERIMENT=1
-
-  # This is for sanity.  Without it, user umasks leak through into release
-  # artifacts.
-  umask 0022
 }
 
 # This will take binaries from $GOPATH/bin and copy them to the appropriate
@@ -678,6 +674,9 @@ kube::golang::build_some_binaries() {
 }
 
 kube::golang::build_binaries_for_platform() {
+  # This is for sanity.  Without it, user umasks can leak through.
+  umask 0022
+
   local platform=$1
 
   local -a statics=()