diff --git a/hack/lib/golang.sh b/hack/lib/golang.sh
index f1c0a3e10ef..b1e42acee5a 100755
--- a/hack/lib/golang.sh
+++ b/hack/lib/golang.sh
@@ -523,6 +523,10 @@ kube::golang::setup_env() {
 
   # This seems to matter to some tools
   export GO15VENDOREXPERIMENT=1
+
+  # This is for sanity.  Without it, user umasks leak through into release
+  # artifacts.
+  umask 0022
 }
 
 # This will take binaries from $GOPATH/bin and copy them to the appropriate