diff --git a/src/basic/mountpoint-util.c b/src/basic/mountpoint-util.c
index e8471d5974..15655cc075 100644
--- a/src/basic/mountpoint-util.c
+++ b/src/basic/mountpoint-util.c
@@ -560,13 +560,13 @@ const char* fstype_norecovery_option(const char *fstype) {
         return mount_option_supported(fstype, "norecovery", NULL) > 0 ? "norecovery" : NULL;
 }
 
-bool fstype_can_umask(const char *fstype) {
+bool fstype_can_fmask_dmask(const char *fstype) {
         assert(fstype);
 
         /* Use a curated list as first check, to avoid calling fsopen() which might load kmods, which might
          * not be allowed in our MAC context. If we don't know ourselves, on new kernels we can just ask the
          * kernel. */
-        return streq(fstype, "vfat") || mount_option_supported(fstype, "umask", "0077") > 0;
+        return streq(fstype, "vfat") || (mount_option_supported(fstype, "fmask", "0177") > 0 && mount_option_supported(fstype, "dmask", "0077") > 0);
 }
 
 bool fstype_can_uid_gid(const char *fstype) {
diff --git a/src/basic/mountpoint-util.h b/src/basic/mountpoint-util.h
index c01f290952..f506e01a41 100644
--- a/src/basic/mountpoint-util.h
+++ b/src/basic/mountpoint-util.h
@@ -62,7 +62,7 @@ bool fstype_is_blockdev_backed(const char *fstype);
 bool fstype_is_ro(const char *fsype);
 bool fstype_can_discard(const char *fstype);
 bool fstype_can_uid_gid(const char *fstype);
-bool fstype_can_umask(const char *fstype);
+bool fstype_can_fmask_dmask(const char *fstype);
 
 const char* fstype_norecovery_option(const char *fstype);
 
diff --git a/src/shared/dissect-image.c b/src/shared/dissect-image.c
index 937b678db4..ce1fa3a3d4 100644
--- a/src/shared/dissect-image.c
+++ b/src/shared/dissect-image.c
@@ -1891,8 +1891,8 @@ int partition_pick_mount_options(
 
                 /* The ESP might contain a pre-boot random seed. Let's make this unaccessible to regular
                  * userspace. ESP/XBOOTLDR is almost certainly VFAT, hence if we don't know assume it is. */
-                if (!fstype || fstype_can_umask(fstype))
-                        if (!strextend_with_separator(&options, ",", "umask=0077"))
+                if (!fstype || fstype_can_fmask_dmask(fstype))
+                        if (!strextend_with_separator(&options, ",", "fmask=0177,dmask=0077"))
                                 return -ENOMEM;
                 break;
 
diff --git a/src/test/test-mountpoint-util.c b/src/test/test-mountpoint-util.c
index 07c0480bce..89093d0212 100644
--- a/src/test/test-mountpoint-util.c
+++ b/src/test/test-mountpoint-util.c
@@ -389,9 +389,9 @@ TEST(fstype_can_norecovery) {
         ASSERT_NULL(fstype_norecovery_option("tmpfs"));
 }
 
-TEST(fstype_can_umask) {
-        assert_se(fstype_can_umask("vfat"));
-        assert_se(!fstype_can_umask("tmpfs"));
+TEST(fstype_can_fmask_dmask) {
+        assert_se(fstype_can_fmask_dmask("vfat"));
+        assert_se(!fstype_can_fmask_dmask("tmpfs"));
 }
 
 TEST(path_get_mnt_id_at_null) {