diff --git a/contrib/unbound/smallapp/unbound-control-setup.sh b/contrib/unbound/smallapp/unbound-control-setup.sh
index 690f45478842..7fe1c3392b32 100755
--- a/contrib/unbound/smallapp/unbound-control-setup.sh
+++ b/contrib/unbound/smallapp/unbound-control-setup.sh
@@ -58,8 +58,8 @@ SVR_BASE=unbound_server
 # base name for unbound-control keys
 CTL_BASE=unbound_control
 
-# we want -rw-r--- access (say you run this as root: grp=yes (server), all=no).
-umask 0026
+# we want -rw-r----- access (say you run this as root: grp=yes (server), all=no).
+umask 0027
 
 # end of options
 
diff --git a/contrib/unbound/smallapp/unbound-control-setup.sh.in b/contrib/unbound/smallapp/unbound-control-setup.sh.in
index 14c5e17d8fa8..a2caffe2c06c 100755
--- a/contrib/unbound/smallapp/unbound-control-setup.sh.in
+++ b/contrib/unbound/smallapp/unbound-control-setup.sh.in
@@ -58,8 +58,8 @@ SVR_BASE=unbound_server
 # base name for unbound-control keys
 CTL_BASE=unbound_control
 
-# we want -rw-r--- access (say you run this as root: grp=yes (server), all=no).
-umask 0026
+# we want -rw-r----- access (say you run this as root: grp=yes (server), all=no).
+umask 0027
 
 # end of options