diff --git a/library/system/cron b/library/system/cron
index 23f8efe09b..f877fc2721 100644
--- a/library/system/cron
+++ b/library/system/cron
@@ -428,6 +428,8 @@ def main():
     changed      = False
     res_args     = dict()
 
+    # Ensure all files generated are only writable by the owning user.  Primarily relevant for the cron_file option.
+    os.umask(022)
     crontab = CronTab(module, user, cron_file)
 
     if crontab.syslogging: