=== modified file 'Makefile'
--- Makefile	2019-02-11 06:31:42 +0000
+++ Makefile	2019-04-09 19:33:36 +0000
@@ -425,6 +425,8 @@
 		$(INITRAMFSTOOLS)/hooks/mandos
 	install --mode=u=rw,go=r initramfs-tools-conf \
 		$(INITRAMFSTOOLS)/conf.d/mandos-conf
+	install --mode=u=rw,go=r initramfs-tools-conf-hook \
+		$(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
 	install initramfs-tools-script \
 		$(INITRAMFSTOOLS)/scripts/init-premount/mandos
 	install initramfs-tools-script-stop \

=== modified file 'debian/mandos-client.dirs'
--- debian/mandos-client.dirs	2018-08-19 14:32:00 +0000
+++ debian/mandos-client.dirs	2019-04-09 19:33:36 +0000
@@ -2,5 +2,6 @@
 usr/sbin
 usr/share/initramfs-tools/hooks
 usr/share/initramfs-tools/conf.d
+usr/share/initramfs-tools/conf-hooks.d
 usr/share/initramfs-tools/scripts/init-premount
 usr/share/initramfs-tools/scripts/local-premount

=== added file 'initramfs-tools-conf-hook'
--- initramfs-tools-conf-hook	1970-01-01 00:00:00 +0000
+++ initramfs-tools-conf-hook	2019-04-09 19:33:36 +0000
@@ -0,0 +1,14 @@
+# -*- shell-script -*-
+
+# The UMASK is set by the file "initramfs-tools-conf" (which is copied
+# to /usr/share/initramfs-tools/conf.d/mandos-conf on installation)
+# since there, as described therein, is the proper place to do that.
+# However, it is possible for other packages to override the UMASK in
+# any file in /usr/share/initramfs-tools/conf-hooks.d.  Therefore,
+# this file ("initramfs-tools-conf-hook") will be installed as
+# "zz-mandos" in that directory to make sure UMASK is set correctly.
+
+# For more information on the effects of setting UMASK, see the
+# aforementioned /usr/share/initramfs-tools/conf.d/mandos-conf file.
+
+UMASK=0027