diff --git a/nixos-config/default.nix b/nixos-config/default.nix
index 06d760b1..c6cb61b2 100644
--- a/nixos-config/default.nix
+++ b/nixos-config/default.nix
@@ -131,6 +131,7 @@
   security = {
     sudo-rs.enable = true;
     rtkit.enable = true;
+    pam.enableUMask = true;
   };
 
   fileSystems."/boot".options = [ "umask=0077" ];