diff --git a/lib/fluent/supervisor.rb b/lib/fluent/supervisor.rb
index ab12ea63ce..b76a4dda1c 100644
--- a/lib/fluent/supervisor.rb
+++ b/lib/fluent/supervisor.rb
@@ -808,6 +808,12 @@ def configure(supervisor: false)
       )
       @system_config = build_system_config(@conf)
 
+      # `<system> umask` sets the process umask, just like the `--umask` command
+      # line option. The command line option takes precedence when both are given.
+      if @system_config.umask && !@cl_opt.key?(:chumask)
+        @chumask = @system_config.umask
+      end
+
       $log.info :supervisor, 'parsing config file is succeeded', path: @config_path
 
       build_additional_configurations(parsed_files) do |additional_conf|
diff --git a/lib/fluent/system_config.rb b/lib/fluent/system_config.rb
index c2a376f11d..2d9240b087 100644
--- a/lib/fluent/system_config.rb
+++ b/lib/fluent/system_config.rb
@@ -30,7 +30,7 @@ class SystemConfig
       :file_permission, :dir_permission, :counter_server, :counter_client,
       :strict_config_value, :enable_msgpack_time_support, :disable_shared_socket,
       :metrics, :enable_input_metrics, :enable_size_metrics, :enable_jit, :source_only_buffer,
-      :config_include_dir
+      :config_include_dir, :umask
     ]
 
     config_param :workers,   :integer, default: 1
@@ -61,6 +61,9 @@ class SystemConfig
       v.to_i(8)
     end
     config_param :config_include_dir, default: Fluent::DEFAULT_CONFIG_INCLUDE_DIR
+    # Kept as a string (like the `--umask` command line option) so that it flows
+    # through the existing chumask handling, which applies `to_i(8)` later.
+    config_param :umask, :string, default: nil
     config_section :log, required: false, init: true, multi: false do
       config_param :path, :string, default: nil
       config_param :format, :enum, list: [:text, :json], default: :text
diff --git a/test/config/test_system_config.rb b/test/config/test_system_config.rb
index a06ee0bbcf..a18cb693aa 100644
--- a/test/config/test_system_config.rb
+++ b/test/config/test_system_config.rb
@@ -101,6 +101,7 @@ def parse_text(text)
       'enable_input_metrics' => ['enable_input_metrics', false],
       'enable_size_metrics' => ['enable_size_metrics', true],
       'enable_jit' => ['enable_jit', true],
+      'umask' => ['umask', '0022'],
     )
     test "accepts parameters" do |(k, v)|
       conf = parse_text(<<-EOS)
diff --git a/test/test_supervisor.rb b/test/test_supervisor.rb
index bb4d6c66b1..3f90b9d6f7 100644
--- a/test/test_supervisor.rb
+++ b/test/test_supervisor.rb
@@ -704,6 +704,21 @@ def test_chumask_should_be_passed_to_ServerEngine((cl_opt, expected_chumask_valu
     supervisor.run_supervisor
   end
 
+  data("system config only", [{}, "0227", "0227"])
+  data("command line takes precedence", [{chumask: "222"}, "0227", "222"])
+  def test_umask_in_system_config_is_passed_to_ServerEngine((cl_opt, system_umask, expected_chumask_value))
+    proxy.mock(Fluent::Supervisor).serverengine_config(hash_including("chumask" => expected_chumask_value))
+    any_instance_of(ServerEngine::Daemon) { |daemon| mock(daemon).run.once }
+
+    supervisor = Fluent::Supervisor.new(cl_opt)
+    system_conf = config_element('ROOT', '', {}, [config_element('system', '', { 'umask' => system_umask })])
+    stub(Fluent::Config).build { system_conf }
+    stub(supervisor).build_spawn_command { "dummy command line" }
+    supervisor.configure(supervisor: true)
+
+    supervisor.run_supervisor
+  end
+
   sub_test_case "init logger" do
     data(supervisor: true)
     data(worker: false)