diff --git a/backup-config.yaml b/backup-config.yaml
index 7f75715..73e142b 100644
--- a/backup-config.yaml
+++ b/backup-config.yaml
@@ -4,7 +4,8 @@ metadata:
   name: backup-config
 data:
   OCP_BACKUP_SUBDIR: "/"
-  OCP_BACKUP_DIRNAME: "+etcd-backup-%F-%H-%M-%S"
+  OCP_BACKUP_DIRNAME: "+etcd-backup-%FT%T%:z"
   OCP_BACKUP_EXPIRE_TYPE: "days"
   OCP_BACKUP_KEEP_DAYS: "30"
   OCP_BACKUP_KEEP_COUNT: "10"
+  OCP_BACKUP_UMASK: "0027"
diff --git a/backup.sh b/backup.sh
index 0d76465..024a928 100755
--- a/backup.sh
+++ b/backup.sh
@@ -30,6 +30,9 @@
 
 set -xeuo pipefail
 
+# set proper umask
+umask "${OCP_BACKUP_UMASK}"
+
 # validate expire type
 case "${OCP_BACKUP_EXPIRE_TYPE}" in
     days|count|never) ;;