diff --git a/ci/Jenkinsfile.hermes-agent-image b/ci/Jenkinsfile.hermes-agent-image
index c07114db..2adc096e 100644
--- a/ci/Jenkinsfile.hermes-agent-image
+++ b/ci/Jenkinsfile.hermes-agent-image
@@ -208,6 +208,7 @@ spec:
               /busybox/printf '{"auths":{"registry.bstein.dev":{"auth":"%s"}}}\n' "${auth}" > "${config_path}"
               unset HARBOR_USER HARBOR_PASSWORD auth
               trap '/busybox/rm -f "${config_path}"' EXIT HUP INT TERM
+              umask 022
               /kaniko/executor \
                 --registry-mirror=harbor-core.harbor.svc.cluster.local \
                 --insecure-registry=harbor-core.harbor.svc.cluster.local \