diff --git a/roles/keytab/tasks/main.yml b/roles/keytab/tasks/main.yml
index cf61b0e402..0b46c9c654 100644
--- a/roles/keytab/tasks/main.yml
+++ b/roles/keytab/tasks/main.yml
@@ -80,7 +80,7 @@
   when: not host_keytab_status.stat.exists
 
 - name: Base64-decode keytab
-  shell: base64 -d /etc/krb5.keytab.b64 >/etc/krb5.keytab
+  shell: "umask 077; base64 -d /etc/krb5.keytab.b64 >/etc/krb5.keytab"
   tags:
   - base
   - config