diff --git a/srcpkgs/shadow/files/login.defs b/srcpkgs/shadow/files/login.defs
index e7eaed9a6d7..a2bc8b51b7c 100644
--- a/srcpkgs/shadow/files/login.defs
+++ b/srcpkgs/shadow/files/login.defs
@@ -74,6 +74,7 @@ TTYPERM 		0600
 #
 ERASECHAR 		0177
 KILLCHAR 		025
+UMASK			077
 
 # Max number of login retries if password is bad
 #
diff --git a/srcpkgs/shadow/template b/srcpkgs/shadow/template
index 6b586aa1a59..19817217a2e 100644
--- a/srcpkgs/shadow/template
+++ b/srcpkgs/shadow/template
@@ -1,7 +1,7 @@
 # Template file for 'shadow'
 pkgname=shadow
 version=4.2.1
-revision=13
+revision=14
 build_pie=yes
 build_style=gnu-configure
 configure_args="--bindir=/usr/bin --sbindir=/usr/bin