diff --git a/config/zsh/login/umask b/config/zsh/login/umask
index e1d6eab..08f5365 100644
--- a/config/zsh/login/umask
+++ b/config/zsh/login/umask
@@ -1,2 +1,14 @@
 #! zsh
-(( $(umask) == 0 )) && umask 022
+# umask should *never* be zero. If it is, set it to something safer.
+if (( $(umask) == 0 )); then
+	# Test whether the system uses User Private Groups - if it does, my primary
+	# group will have the same name as my user. Basic info on UPG can be found
+	# here: https://security.ias.edu/how-and-why-user-private-groups-unix
+	if [[ $(id -un) = $(id -gn) ]]; then
+		# 002 is a safe umask if the system has UPG.
+		umask 002
+	else
+		# 022 is a safe umask if the system does not have UPG.
+		umask 022
+	fi
+fi