diff --git a/borg/archiver.py b/borg/archiver.py
index 84e568e73..b8faa62f3 100644
--- a/borg/archiver.py
+++ b/borg/archiver.py
@@ -21,7 +21,7 @@ from .helpers import Error, location_validator, format_time, format_file_size, \
     format_file_mode, ExcludePattern, exclude_path, adjust_patterns, to_localtime, timestamp, \
     get_cache_dir, get_keys_dir, format_timedelta, prune_within, prune_split, \
     Manifest, remove_surrogates, update_excludes, format_archive, check_extension_modules, Statistics, \
-    is_cachedir, bigint_to_int, ChunkerParams
+    is_cachedir, bigint_to_int, ChunkerParams, set_umask
 from .remote import RepositoryServer, RemoteRepository
 
 
@@ -220,7 +220,6 @@ Type "Yes I am sure" if you understand this and want to continue.\n""")
         # be restrictive when restoring files, restore permissions later
         if sys.getfilesystemencoding() == 'ascii':
             print('Warning: File system encoding is "ascii", extracting non-ascii filenames will not be supported.')
-        os.umask(0o077)
         repository = self.open_repository(args.archive)
         manifest, key = Manifest.load(repository)
         archive = Archive(repository, key, manifest, args.archive.archive,
@@ -511,6 +510,8 @@ Type "Yes I am sure" if you understand this and want to continue.\n""")
                                    default=False,
                                    help='verbose output')
         common_parser.add_argument('--no-files-cache', dest='cache_files', action='store_false')
+        common_parser.add_argument('--umask', dest='umask', type=lambda s: int(s, 8), default=0o077, metavar='M',
+                                   help='set umask to M (local and remote, default: 0o077)')
 
         # We can't use argparse for "serve" since we don't want it to show up in "Available commands"
         if args:
@@ -821,6 +822,7 @@ Type "Yes I am sure" if you understand this and want to continue.\n""")
 
         args = parser.parse_args(args or ['-h'])
         self.verbose = args.verbose
+        set_umask(args.umask)
         update_excludes(args)
         return args.func(args)
 
diff --git a/borg/helpers.py b/borg/helpers.py
index d20532723..7043822b7 100644
--- a/borg/helpers.py
+++ b/borg/helpers.py
@@ -605,3 +605,13 @@ def int_to_bigint(value):
     if value.bit_length() > 63:
         return value.to_bytes((value.bit_length() + 9) // 8, 'little', signed=True)
     return value
+
+
+def set_umask(umask):
+    return os.umask(umask)
+
+
+def get_umask():
+    umask = set_umask(0)
+    set_umask(umask)
+    return umask
diff --git a/borg/remote.py b/borg/remote.py
index afec54710..aede16d9e 100644
--- a/borg/remote.py
+++ b/borg/remote.py
@@ -10,7 +10,7 @@ import traceback
 
 from . import __version__
 
-from .helpers import Error, IntegrityError
+from .helpers import Error, IntegrityError, get_umask
 from .repository import Repository
 
 BUFSIZE = 10 * 1024 * 1024
@@ -124,8 +124,10 @@ class RemoteRepository:
         self.responses = {}
         self.unpacker = msgpack.Unpacker(use_list=False)
         self.p = None
+        # use local umask also for the remote process
+        umask = ['--umask', '%03o' % get_umask()]
         if location.host == '__testsuite__':
-            args = [sys.executable, '-m', 'borg.archiver', 'serve'] + self.extra_test_args
+            args = [sys.executable, '-m', 'borg.archiver', 'serve'] + umask + self.extra_test_args
         else:
             args = ['ssh']
             if location.port:
@@ -134,7 +136,7 @@ class RemoteRepository:
                 args.append('%s@%s' % (location.user, location.host))
             else:
                 args.append('%s' % location.host)
-            args += ['borg', 'serve']
+            args += ['borg', 'serve'] + umask
         self.p = Popen(args, bufsize=0, stdin=PIPE, stdout=PIPE)
         self.stdin_fd = self.p.stdin.fileno()
         self.stdout_fd = self.p.stdout.fileno()
diff --git a/borg/testsuite/archiver.py b/borg/testsuite/archiver.py
index 35f8171d9..b466d6ad6 100644
--- a/borg/testsuite/archiver.py
+++ b/borg/testsuite/archiver.py
@@ -425,6 +425,13 @@ class ArchiverTestCase(ArchiverTestCaseBase):
             # Restore permissions so shutil.rmtree is able to delete it
             os.system('chmod -R u+w ' + self.repository_path)
 
+    def test_umask(self):
+        self.create_regular_file('file1', size=1024 * 80)
+        self.cmd('init', self.repository_location)
+        self.cmd('create', self.repository_location + '::test', 'input')
+        mode = os.stat(self.repository_path).st_mode
+        self.assertEqual(stat.S_IMODE(mode), 0o700)
+
     def test_cmdline_compatibility(self):
         self.create_regular_file('file1', size=1024 * 80)
         self.cmd('init', self.repository_location)