diff --git a/tests/test_gcp_leoclean_nosend_iap_runner.py b/tests/test_gcp_leoclean_nosend_iap_runner.py
index ebf6d89..dcd16c2 100644
--- a/tests/test_gcp_leoclean_nosend_iap_runner.py
+++ b/tests/test_gcp_leoclean_nosend_iap_runner.py
@@ -549,7 +549,11 @@ def test_remote_main_emits_structured_failure_on_stdout(
     failure = verifier_failure_result(executable_plan(tmp_path, "install"))
     monkeypatch.setattr(remote, "receive_request", lambda *_args: failure)
 
-    returncode = remote.main(["install", "request", "runner", "release", "archive", "helper"])
+    previous_umask = os.umask(0o077)
+    try:
+        returncode = remote.main(["install", "request", "runner", "release", "archive", "helper"])
+    finally:
+        os.umask(previous_umask)
 
     captured = capsys.readouterr()
     assert returncode == 65