diff --git a/srcpkgs/shadow/files/login.defs b/srcpkgs/shadow/files/login.defs
index de7f2d32135..cde442ec4e5 100644
--- a/srcpkgs/shadow/files/login.defs
+++ b/srcpkgs/shadow/files/login.defs
@@ -74,7 +74,7 @@ TTYPERM 		0600
 #
 ERASECHAR 		0177
 KILLCHAR 		025
-UMASK 			022
+UMASK 			077
 
 # Max number of login retries if password is bad
 #
diff --git a/srcpkgs/shadow/template b/srcpkgs/shadow/template
index d73d298529d..7274087f151 100644
--- a/srcpkgs/shadow/template
+++ b/srcpkgs/shadow/template
@@ -1,7 +1,7 @@
 # Template file for 'shadow'
 pkgname=shadow
 version=4.2.1
-revision=11
+revision=12
 build_pie=yes
 build_style=gnu-configure
 configure_args="--bindir=/usr/bin --sbindir=/usr/bin