diff --git a/docs/HowTo.md b/docs/HowTo.md
index ed19a4a..51a4247 100644
--- a/docs/HowTo.md
+++ b/docs/HowTo.md
@@ -150,6 +150,7 @@ or with pinning:
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
               };
             };
             root = {
diff --git a/docs/disko-install.md b/docs/disko-install.md
index 18b7788..f4d6f5b 100644
--- a/docs/disko-install.md
+++ b/docs/disko-install.md
@@ -65,6 +65,7 @@ example we assume a system that has been booted with EFI:
                       type = "filesystem";
                       format = "vfat";
                       mountpoint = "/boot";
+                      mountOptions = [ "umask=0077" ];
                     };
                   };
                   root = {
@@ -168,6 +169,7 @@ Add this to your flake.nix output:
                       type = "filesystem";
                       format = "vfat";
                       mountpoint = "/boot";
+                      mountOptions = [ "umask=0077" ];
                     };
                   };
                   root = {
diff --git a/docs/table-to-gpt.md b/docs/table-to-gpt.md
index e739379..a3db41f 100644
--- a/docs/table-to-gpt.md
+++ b/docs/table-to-gpt.md
@@ -122,6 +122,7 @@ The fixed disko configuration would look like this:
             type = "filesystem";
             format = "vfat";
             mountpoint = "/boot";
+            mountOptions = [ "umask=0077" ];
           };
         };
         root = {
diff --git a/example/bcachefs.nix b/example/bcachefs.nix
index 8ec19e6..c7e3bf3 100644
--- a/example/bcachefs.nix
+++ b/example/bcachefs.nix
@@ -14,6 +14,7 @@
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
               };
             };
             root = {
diff --git a/example/btrfs-only-root-subvolume.nix b/example/btrfs-only-root-subvolume.nix
index 91ba72e..46e7334 100644
--- a/example/btrfs-only-root-subvolume.nix
+++ b/example/btrfs-only-root-subvolume.nix
@@ -17,6 +17,7 @@
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
               };
             };
             root = {
diff --git a/example/btrfs-subvolumes.nix b/example/btrfs-subvolumes.nix
index 31c4a4a..8f36443 100644
--- a/example/btrfs-subvolumes.nix
+++ b/example/btrfs-subvolumes.nix
@@ -17,6 +17,7 @@
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
               };
             };
             root = {
diff --git a/example/complex.nix b/example/complex.nix
index 661a541..210105e 100644
--- a/example/complex.nix
+++ b/example/complex.nix
@@ -15,6 +15,7 @@
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
               };
             };
           };
diff --git a/example/f2fs.nix b/example/f2fs.nix
index 838b1a1..baf8852 100644
--- a/example/f2fs.nix
+++ b/example/f2fs.nix
@@ -14,6 +14,7 @@
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
               };
             };
             root = {
diff --git a/example/hybrid-mbr.nix b/example/hybrid-mbr.nix
index 4112005..d96c898 100644
--- a/example/hybrid-mbr.nix
+++ b/example/hybrid-mbr.nix
@@ -29,6 +29,7 @@
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
               };
             };
             root = {
diff --git a/example/hybrid-tmpfs-on-root.nix b/example/hybrid-tmpfs-on-root.nix
index 308f7bf..55dbbf5 100644
--- a/example/hybrid-tmpfs-on-root.nix
+++ b/example/hybrid-tmpfs-on-root.nix
@@ -18,6 +18,7 @@
               type = "filesystem";
               format = "vfat";
               mountpoint = "/boot";
+              mountOptions = [ "umask=0077" ];
             };
           };
           nix = {
diff --git a/example/hybrid.nix b/example/hybrid.nix
index 50176e0..9825e85 100644
--- a/example/hybrid.nix
+++ b/example/hybrid.nix
@@ -18,6 +18,7 @@
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
               };
             };
             root = {
@@ -34,4 +35,3 @@
     };
   };
 }
-
diff --git a/example/long-device-name.nix b/example/long-device-name.nix
index 7f8af8b..ab43696 100644
--- a/example/long-device-name.nix
+++ b/example/long-device-name.nix
@@ -15,6 +15,7 @@
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
               };
             };
             root = {
@@ -31,4 +32,3 @@
     };
   };
 }
-
diff --git a/example/luks-btrfs-subvolumes.nix b/example/luks-btrfs-subvolumes.nix
index 9689f5a..eb1b6c0 100644
--- a/example/luks-btrfs-subvolumes.nix
+++ b/example/luks-btrfs-subvolumes.nix
@@ -14,9 +14,7 @@
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
-                mountOptions = [
-                  "defaults"
-                ];
+                mountOptions = [ "umask=0077" ];
               };
             };
             luks = {
diff --git a/example/luks-interactive-login.nix b/example/luks-interactive-login.nix
index b52e0f1..0aaf776 100644
--- a/example/luks-interactive-login.nix
+++ b/example/luks-interactive-login.nix
@@ -14,6 +14,7 @@
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
               };
             };
             luks = {
diff --git a/example/luks-lvm.nix b/example/luks-lvm.nix
index 1ae4a2e..768451b 100644
--- a/example/luks-lvm.nix
+++ b/example/luks-lvm.nix
@@ -14,9 +14,7 @@
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
-                mountOptions = [
-                  "defaults"
-                ];
+                mountOptions = [ "umask=0077" ];
               };
             };
             luks = {
diff --git a/example/lvm-sizes-sort.nix b/example/lvm-sizes-sort.nix
index 90b1576..1309e3b 100644
--- a/example/lvm-sizes-sort.nix
+++ b/example/lvm-sizes-sort.nix
@@ -14,6 +14,7 @@
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
               };
             };
             primary = {
diff --git a/example/lvm-thin.nix b/example/lvm-thin.nix
index 41aa19b..054f5a3 100644
--- a/example/lvm-thin.nix
+++ b/example/lvm-thin.nix
@@ -14,9 +14,7 @@
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
-                mountOptions = [
-                  "defaults"
-                ];
+                mountOptions = [ "umask=0077" ];
               };
             };
             primary = {
diff --git a/example/non-root-zfs.nix b/example/non-root-zfs.nix
index 341cd83..2e3f4ac 100644
--- a/example/non-root-zfs.nix
+++ b/example/non-root-zfs.nix
@@ -14,6 +14,7 @@
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
               };
             };
             root = {
@@ -106,4 +107,3 @@
     };
   };
 }
-
diff --git a/example/simple-efi.nix b/example/simple-efi.nix
index 1a6ac91..435596b 100644
--- a/example/simple-efi.nix
+++ b/example/simple-efi.nix
@@ -14,6 +14,7 @@
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
               };
             };
             root = {
@@ -30,4 +31,3 @@
     };
   };
 }
-
diff --git a/example/swap.nix b/example/swap.nix
index 976847c..b5a61b7 100644
--- a/example/swap.nix
+++ b/example/swap.nix
@@ -14,6 +14,7 @@
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
               };
             };
             root = {
diff --git a/example/tmpfs.nix b/example/tmpfs.nix
index 5a7340e..4f0c3a3 100644
--- a/example/tmpfs.nix
+++ b/example/tmpfs.nix
@@ -14,6 +14,7 @@
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
               };
             };
             root = {
@@ -38,4 +39,3 @@
     };
   };
 }
-
diff --git a/example/zfs-over-legacy.nix b/example/zfs-over-legacy.nix
index b90e9a3..e55c0d4 100644
--- a/example/zfs-over-legacy.nix
+++ b/example/zfs-over-legacy.nix
@@ -14,9 +14,7 @@
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
-                mountOptions = [
-                  "defaults"
-                ];
+                mountOptions = [ "umask=0077" ];
               };
             };
             primary = {
@@ -57,4 +55,3 @@
     };
   };
 }
-
diff --git a/example/zfs-with-vdevs.nix b/example/zfs-with-vdevs.nix
index a61680a..2161f5c 100644
--- a/example/zfs-with-vdevs.nix
+++ b/example/zfs-with-vdevs.nix
@@ -14,6 +14,7 @@
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
               };
             };
             zfs = {
@@ -84,7 +85,10 @@
             vdev = [
               {
                 mode = "mirror";
-                members = [ "x" "y" ];
+                members = [
+                  "x"
+                  "y"
+                ];
               }
             ];
             special = {
diff --git a/example/zfs.nix b/example/zfs.nix
index 339c732..2c00af7 100644
--- a/example/zfs.nix
+++ b/example/zfs.nix
@@ -14,6 +14,7 @@
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
               };
             };
             zfs = {
@@ -102,4 +103,3 @@
     };
   };
 }
-