diff --git a/scripts/lib/upgrade-zulip b/scripts/lib/upgrade-zulip
index bc422d35ed..6463c2ddf4 100755
--- a/scripts/lib/upgrade-zulip
+++ b/scripts/lib/upgrade-zulip
@@ -20,6 +20,9 @@ deploy_options = get_deploy_options(config_file)
 
 assert_running_as_root(strip_lib_from_paths=True)
 
+# make sure we have appropriate file permissions
+os.umask(0o22)
+
 logging.Formatter.converter = time.gmtime
 logging.basicConfig(format="%(asctime)s upgrade-zulip: %(message)s",
                     level=logging.INFO)
diff --git a/scripts/lib/upgrade-zulip-from-git b/scripts/lib/upgrade-zulip-from-git
index 1caca155a8..2168fb44ec 100755
--- a/scripts/lib/upgrade-zulip-from-git
+++ b/scripts/lib/upgrade-zulip-from-git
@@ -20,6 +20,9 @@ remote_url = get_config(config_file, 'deployment', 'git_repo_url', "https://gith
 
 assert_running_as_root(strip_lib_from_paths=True)
 
+# make sure we have appropriate file permissions
+os.umask(0o22)
+
 logging.Formatter.converter = time.gmtime
 logging.basicConfig(format="%(asctime)s upgrade-zulip-from-git: %(message)s",
                     level=logging.INFO)