diff --git a/system/cron b/system/cron
index 81e411168b7..04dd065db0b 100644
--- a/system/cron
+++ b/system/cron
@@ -426,6 +426,8 @@ def main():
     changed      = False
     res_args     = dict()
 
+    # Ensure all files generated are only writable by the owning user.  Primarily relevant for the cron_file option.
+    os.umask(022)
     crontab = CronTab(module, user, cron_file)
 
     if crontab.syslogging: