diff --git a/README.md b/README.md
index 08481e9..2fcb546 100644
--- a/README.md
+++ b/README.md
@@ -148,6 +148,7 @@ If you change this setting and it works well for you, please leave a comment on
 | --------------------------- | --------- | ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
 | `TZ`                        | No        | `UTC`                     | Must follow IANA TZ format                                                                                                                |
 | `LOG_LEVEL`                 | No        | `debug`                   | Can be set to `info` but `debug` is strongly recommended                                                                                  |
+| `UMASK`                     | No        | `022`                     | Unraid users may want to set this to `000`                                                                                                |
 | `BASIC_AUTH_USERNAME`       | No        |                           | See [authentication docs](https://github.com/kieraneglin/pinchflat/wiki/Username-and-Password)                                            |
 | `BASIC_AUTH_PASSWORD`       | No        |                           | See [authentication docs](https://github.com/kieraneglin/pinchflat/wiki/Username-and-Password)                                            |
 | `EXPOSE_FEED_ENDPOINTS`     | No        | `false`                   | See [RSS feed docs](https://github.com/kieraneglin/pinchflat/wiki/Podcast-RSS-Feeds)                                                      |
diff --git a/docker/selfhosted.Dockerfile b/docker/selfhosted.Dockerfile
index a9956fc..3713686 100644
--- a/docker/selfhosted.Dockerfile
+++ b/docker/selfhosted.Dockerfile
@@ -7,7 +7,7 @@ ARG DEBIAN_VERSION=bookworm-20240612-slim
 ARG BUILDER_IMAGE="hexpm/elixir:${ELIXIR_VERSION}-erlang-${OTP_VERSION}-debian-${DEBIAN_VERSION}"
 ARG RUNNER_IMAGE="debian:${DEBIAN_VERSION}"
 
-FROM ${BUILDER_IMAGE} as builder
+FROM ${BUILDER_IMAGE} AS builder
 
 ARG TARGETPLATFORM
 RUN echo "Building for ${TARGETPLATFORM:?}"
@@ -110,9 +110,9 @@ RUN apt-get update -y && \
     rm -rf /var/lib/apt/lists/*
 
 # More locale setup
-ENV LANG en_US.UTF-8
-ENV LANGUAGE en_US:en
-ENV LC_ALL en_US.UTF-8
+ENV LANG=en_US.UTF-8
+ENV LANGUAGE=en_US:en
+ENV LC_ALL=en_US.UTF-8
 
 WORKDIR "/app"
 
@@ -124,6 +124,7 @@ RUN mkdir -p /config /downloads /etc/elixir_tzdata_data /etc/yt-dlp/plugins && \
 ENV MIX_ENV="prod"
 ENV PORT=${PORT}
 ENV RUN_CONTEXT="selfhosted"
+ENV UMASK=022
 EXPOSE ${PORT}
 
 # Only copy the final release from the build stage
diff --git a/rel/overlays/bin/docker_start b/rel/overlays/bin/docker_start
index 4f2d132..b60c6d3 100755
--- a/rel/overlays/bin/docker_start
+++ b/rel/overlays/bin/docker_start
@@ -6,6 +6,9 @@ if [ $? -ne 0 ]; then
   exit 1
 fi
 
+echo "Setting umask to ${UMASK}"
+umask ${UMASK}
+
 /app/bin/migrate
 
 cd -P -- "$(dirname -- "$0")"