diff --git a/docs/installation.md b/docs/installation.md
index c3cc1bfee..0d5063cb6 100644
--- a/docs/installation.md
+++ b/docs/installation.md
@@ -84,7 +84,7 @@ curl https://storage.googleapis.com/cri-containerd-release/cri-containerd-${VERS
 ## Step 2: Install Containerd
 If you are using systemd, just simply unpack the tarball to the root directory:
 ```bash
-sudo tar -C / -xzf cri-containerd-${VERSION}.linux-amd64.tar.gz
+sudo tar --no-overwrite-dir -C / -xzf cri-containerd-${VERSION}.linux-amd64.tar.gz
 sudo systemctl start containerd
 ```
 If you are not using systemd, please unpack all binaries into a directory in your `PATH`, and start `containerd` as monitored long running services with the service manager you are using e.g. `supervisord`, `upstart` etc.
diff --git a/hack/release.sh b/hack/release.sh
index 616d0ecc4..e59e1a74c 100755
--- a/hack/release.sh
+++ b/hack/release.sh
@@ -21,6 +21,8 @@ set -o pipefail
 source $(dirname "${BASH_SOURCE[0]}")/utils.sh
 cd ${ROOT}
 
+umask 0022
+
 # BUILD_DIR is the directory to generate release tar.
 # TARBALL is the name of the release tar.
 BUILD_DIR=${BUILD_DIR:-"_output"}