diff --git a/scripts_debian/02_install_groups.sh b/scripts_debian/02_install_groups.sh
index b60a8d4..bfd3772 100755
--- a/scripts_debian/02_install_groups.sh
+++ b/scripts_debian/02_install_groups.sh
@@ -58,6 +58,11 @@ return 101 # Action forbidden by policy
 EOF
     chmod 755 "$INSTALLDIR/usr/sbin/policy-rc.d"
 
+    # ------------------------------------------------------------------------------
+    # Ensure umask set in /etc/login.defs is used (022)
+    # ------------------------------------------------------------------------------
+    echo "session optional pam_umask.so" >> "${INSTALLDIR}/etc/pam.d/common-session"
+
     # ------------------------------------------------------------------------------
     # Add debian security repository
     # ------------------------------------------------------------------------------
diff --git a/scripts_debian/wheezy+whonix/02_install_groups_packages_installed.sh b/scripts_debian/wheezy+whonix/02_install_groups_packages_installed.sh
index 82d9372..f1b0ce9 100755
--- a/scripts_debian/wheezy+whonix/02_install_groups_packages_installed.sh
+++ b/scripts_debian/wheezy+whonix/02_install_groups_packages_installed.sh
@@ -103,9 +103,6 @@ sudo touch /root/.whonix/first_run_initializer.done
 # Prevent whonixcheck error
 sudo su -c 'echo WHONIXCHECK_NO_EXIT_ON_UNSUPPORTED_VIRTUALIZER=\"1\" >> /etc/whonix.d/30_whonixcheck_default'
 
-# Ensure umask set in /etc/login.defs is used (022)
-sudo su -c 'echo "session optional pam_umask.so" >> /etc/pam.d/common-session'
-
 sudo update-rc.d network-manager disable
 sudo update-rc.d spice-vdagent disable
 sudo update-rc.d swap-file-creator disable