diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index 35bdd89cb8..2548c989a9 100644
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -2618,8 +2618,6 @@ static int inner_child(
                 return r;
         kmsg_socket = safe_close(kmsg_socket);
 
-        umask(0022);
-
         if (setsid() < 0)
                 return log_error_errno(errno, "setsid() failed: %m");
 
@@ -4238,6 +4236,11 @@ int main(int argc, char *argv[]) {
                 }
         }
 
+        /* The "default" umask. This is appropriate for most file and directory
+        * operations performed by nspawn, and is the umask that will be used for
+        * the child. Functions like copy_devnodes() change the umask temporarily. */
+        umask(0022);
+
         if (arg_directory) {
                 assert(!arg_image);