diff --git a/lib/puppet/file_system/uniquefile.rb b/lib/puppet/file_system/uniquefile.rb
index c54db61469..faf3e61ab2 100644
--- a/lib/puppet/file_system/uniquefile.rb
+++ b/lib/puppet/file_system/uniquefile.rb
@@ -30,21 +30,18 @@ def self.open_tmp(identifier)
   def initialize(basename, *rest)
     create_tmpname(basename, *rest) do |tmpname, _n, opts|
       mode = File::RDWR | File::CREAT | File::EXCL
-      perm = 0o600
       if opts
         mode |= opts.delete(:mode) || 0
-        opts[:perm] = perm
-        perm = nil
+        opts.delete(:perm)
       else
-        opts = perm
+        opts = {}
       end
       self.class.locking(tmpname) do
-        @tmpfile = File.open(tmpname, mode, opts)
+        @tmpfile = File.open(tmpname, mode, 0o600, **opts)
         @tmpname = tmpname
       end
       @mode = mode & ~(File::CREAT | File::EXCL)
-      perm or opts.freeze
-      @opts = opts
+      @opts = opts.freeze
     end
 
     super(@tmpfile)
@@ -53,7 +50,7 @@ def initialize(basename, *rest)
   # Opens or reopens the file with mode "r+".
   def open
     @tmpfile.close if @tmpfile
-    @tmpfile = File.open(@tmpname, @mode, @opts)
+    @tmpfile = File.open(@tmpname, @mode, 0o600, **@opts)
     __setobj__(@tmpfile)
   end
 
diff --git a/spec/unit/file_system/uniquefile_spec.rb b/spec/unit/file_system/uniquefile_spec.rb
index 7aa4ed661f..c4c74441a5 100644
--- a/spec/unit/file_system/uniquefile_spec.rb
+++ b/spec/unit/file_system/uniquefile_spec.rb
@@ -108,6 +108,28 @@
     end
   end
 
+  context "when constructed with an options hash" do
+    after(:each) do
+      @tempfile.close! if @tempfile
+    end
+
+    it "accepts an options hash without raising an error" do
+      expect {
+        @tempfile = Puppet::FileSystem::Uniquefile.new('foo', Dir.tmpdir, mode: 0)
+      }.not_to raise_error
+    end
+
+    it "ensures the file has permissions 0600", unless: Puppet::Util::Platform.windows? do
+      @tempfile = Puppet::FileSystem::Uniquefile.new('foo', Dir.tmpdir, perm: 0o640)
+      expect(Puppet::FileSystem.stat(@tempfile.path).mode & 0o7777).to eq(0o600)
+    end
+
+    it "passes File.open args like :encoding through to the underlying file" do
+      @tempfile = Puppet::FileSystem::Uniquefile.new('foo', Dir.tmpdir, encoding: 'UTF-8')
+      expect(@tempfile.external_encoding.to_s).to eq('UTF-8')
+    end
+  end
+
   context "Ruby 1.9.3 Tempfile tests" do
     # the remaining tests in this file are ported directly from the ruby 1.9.3 source,
     # since most of this file was ported from there