diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go
index 35571a298..84ba55e05 100644
--- a/libcontainer/rootfs_linux.go
+++ b/libcontainer/rootfs_linux.go
@@ -295,11 +295,6 @@ func finalizeRootfs(config *configs.Config) (err error) {
 		}
 	}
 
-	if config.Umask != nil {
-		unix.Umask(int(*config.Umask))
-	} else {
-		unix.Umask(0o022)
-	}
 	return nil
 }
 
diff --git a/libcontainer/standard_init_linux.go b/libcontainer/standard_init_linux.go
index afc4cbb09..43ed700f2 100644
--- a/libcontainer/standard_init_linux.go
+++ b/libcontainer/standard_init_linux.go
@@ -118,6 +118,14 @@ func (l *linuxStandardInit) Init() error {
 		}
 	}
 
+	// Set the umask. This is not related to the rootfs setup, so it has to be
+	// done even when the container does not have its own mount namespace.
+	if l.config.Config.Umask != nil {
+		unix.Umask(int(*l.config.Config.Umask))
+	} else {
+		unix.Umask(0o022)
+	}
+
 	if hostname := l.config.Config.Hostname; hostname != "" {
 		if err := unix.Sethostname([]byte(hostname)); err != nil {
 			return &os.SyscallError{Syscall: "sethostname", Err: err}