diff --git a/debian.gromox.postinst b/debian.gromox.postinst
index d356906..b918e31 100644
--- a/debian.gromox.postinst
+++ b/debian.gromox.postinst
@@ -17,18 +17,20 @@ set_perms()
 
 xpostinst()
 {
-set_perms root grommunio 0770 /etc/gromox || :
+set_perms grommunio gromox 0755 /etc/gromox || :
 for i in /var/lib/gromox \
+	/var/lib/gromox/domain \
+	/var/lib/gromox/user \
 	/var/lib/gromox/queue \
 	/var/lib/gromox/queue/cache \
 	/var/lib/gromox/queue/clone \
 	/var/lib/gromox/queue/insulation \
 	/var/lib/gromox/queue/mess \
 	/var/lib/gromox/queue/save \
-	/var/lib/gromox/queue/timer \
-	/var/log/gromox; do
+	/var/lib/gromox/queue/timer; do
 	set_perms gromox gromox 0770 "$i" || :
 done
+set_perms gromox gromox 0750 /var/log/gromox || :
 
 # %post
 if test -x /usr/bin/systemd-tmpfiles; then
diff --git a/gromox.changes b/gromox.changes
index 1d10529..5f1f272 100644
--- a/gromox.changes
+++ b/gromox.changes
@@ -3,6 +3,7 @@ Mon Mar 13 09:13:31 UTC 2023 - Jan Engelhardt <jengelh@inai.de>
 
 - Add 0001-snapshot-safer-parsing-of-snapshot.cfg.patch
   [boo#1209051]
+- Updated directory permissions
 
 -------------------------------------------------------------------
 Thu Mar  9 23:44:07 UTC 2023 - Jan Engelhardt <jengelh@inai.de>
diff --git a/gromox.spec b/gromox.spec
index 496d1d9..8734cc0 100644
--- a/gromox.spec
+++ b/gromox.spec
@@ -226,9 +226,9 @@ fi
 
 %files
 %_sysconfdir/php*
-# Group write permission is exercised by grommunio-admin-api.
-# pam.cfg needs to be readable by all
-%attr(0775,root,grommunio) %dir %_sysconfdir/%name/
+# grommunio permission is exercised by grommunio-admin-api.
+# pam.cfg needs to be readable by all (hence d0755).
+%attr(0755,grommunio,gromox) %dir %_sysconfdir/%name/
 %_sbindir/gromox-*
 %_libdir/*.so.*
 %_libdir/%name/
@@ -240,7 +240,7 @@ fi
 %_tmpfilesdir/*.conf
 %_unitdir/*
 %attr(0770,gromox,gromox) /var/lib/gromox/
-%attr(0770,gromox,gromox) /var/log/gromox/
+%attr(0750,gromox,gromox) /var/log/gromox/
 %if 0%{?suse_version} >= 1500 && 0%{?suse_version} < 1550
 %dir %_libexecdir
 %endif