diff --git a/oe-init-build-env b/oe-init-build-env
index 82382f27078..5d830455f74 100755
--- a/oe-init-build-env
+++ b/oe-init-build-env
@@ -57,3 +57,5 @@ unset OEROOT
 
 [ -z "$BUILDDIR" ] || cd "$BUILDDIR"
 
+# explicitly set relative umask to deal with security hardening
+umask u+rwx,g+rx,o+rx