diff --git a/src/confd/src/hardware.c b/src/confd/src/hardware.c
index b7d0cbc5..2b6f13d5 100644
--- a/src/confd/src/hardware.c
+++ b/src/confd/src/hardware.c
@@ -458,12 +458,14 @@ static int wifi_gen_aps_on_radio(const char *radio_name, struct lyd_node *cifs,
 	char hostapd_conf[256];
 	char **ap_list = NULL;
 	FILE *hostapd = NULL;
-	int ap_count = 0;
 	int rc = SR_ERR_OK;
+	int ap_count = 0;
+	mode_t oldmask;
 	int i;
 
-	wifi_find_radio_aps(cifs, radio_name, &ap_list, &ap_count);
+	oldmask = umask(0077);
 
+	wifi_find_radio_aps(cifs, radio_name, &ap_list, &ap_count);
 	if (ap_count == 0) {
 		DEBUG("No APs found on radio %s", radio_name);
 		goto cleanup;
@@ -538,6 +540,8 @@ static int wifi_gen_aps_on_radio(const char *radio_name, struct lyd_node *cifs,
 	fclose(hostapd);
 
 cleanup:
+	umask(oldmask);
+
 	for (i = 0; i < ap_count; i++)
 		free(ap_list[i]);
 	free(ap_list);
diff --git a/src/confd/src/if-wifi.c b/src/confd/src/if-wifi.c
index 84081f12..d6567d6b 100644
--- a/src/confd/src/if-wifi.c
+++ b/src/confd/src/if-wifi.c
@@ -61,6 +61,7 @@ static int wifi_gen_station(struct lyd_node *cif)
 	char *security_str = NULL;
 	const char *country;
 	int rc = SR_ERR_OK;
+	mode_t oldmask;
 
 	ifname = lydx_get_cattr(cif, "name");
 	wifi = lydx_get_child(cif, "wifi");
@@ -95,6 +96,7 @@ static int wifi_gen_station(struct lyd_node *cif)
 		secret = NULL;
 	}
 
+	oldmask = umask(0077);
 	wpa_supplicant = fopenf("w", WPA_SUPPLICANT_CONF, ifname);
 	if (!wpa_supplicant) {
 		rc = SR_ERR_INTERNAL;
@@ -132,6 +134,8 @@ static int wifi_gen_station(struct lyd_node *cif)
 out:
 	if (wpa_supplicant)
 		fclose(wpa_supplicant);
+	umask(oldmask);
+
 	return rc;
 }