diff --git a/install.sh b/install.sh
index ae71ed4e..3aae5ca7 100755
--- a/install.sh
+++ b/install.sh
@@ -627,10 +627,15 @@ ensure_systemd_service_stopped() {
 create_env_file() {
     FILE_SA_ENV="/etc/systemd/system/rancher-system-agent.env"
     info "Creating environment file ${FILE_SA_ENV}"
-    UMASK=$(umask)
-    umask 0377
-    env | grep -E -i '^(NO|HTTP|HTTPS)_PROXY' | tee ${FILE_SA_ENV} >/dev/null
-    umask "${UMASK}"
+    install -m 0600 /dev/null "${FILE_SA_ENV}"
+    for i in "HTTP_PROXY" "HTTPS_PROXY" "NO_PROXY"; do
+      eval v=\"\$$i\"
+      if [ -z "${v}" ]; then
+        env | grep -E -i "^${i}" | tee -a ${FILE_SA_ENV} >/dev/null
+      else
+        echo "$i=$v" | tee -a ${FILE_SA_ENV} >/dev/null
+      fi
+    done
 }
 
 do_install() {
diff --git a/package/suc/run.sh b/package/suc/run.sh
index 7334de95..6fadcc7c 100755
--- a/package/suc/run.sh
+++ b/package/suc/run.sh
@@ -36,7 +36,14 @@ fi
 export CATTLE_AGENT_BINARY_LOCAL=true
 export CATTLE_AGENT_BINARY_LOCAL_LOCATION=${TMPDIR}/rancher-system-agent
 if [ -s /host/etc/systemd/system/rancher-system-agent.env ]; then
-  export $(grep -v '^#' /host/etc/systemd/system/rancher-system-agent.env | xargs)
+  for line in $(grep -v '^#' /host/etc/systemd/system/rancher-system-agent.env); do
+    var=${line%%=*}
+    val=${line##*=}
+    eval v=\"\$$var\"
+    if [ -z "$v" ]; then
+      export "$var=$val"
+    fi
+  done
 fi
 chroot /host ${TMPDIR}/install.sh "$@"