diff --git a/README.md b/README.md
index f60d370..10486d8 100644
--- a/README.md
+++ b/README.md
@@ -48,7 +48,8 @@ python3 -m venv /opt/micronas/venv
 
 ```bash
 mkdir -p /etc/micronas
-chmod 700 /etc/micronas
+chmod 750 /etc/micronas
+chown root:www-data /etc/micronas
 ```
 
 Credentials are set on first login via the `/setup` page in the browser. No manual env file editing needed.
diff --git a/app.py b/app.py
index a5bddc6..2768d06 100644
--- a/app.py
+++ b/app.py
@@ -49,7 +49,8 @@ def _verify_password(password):
 
 def _save_credentials(user, password):
     h = _hash_password(password)
-    os.makedirs(_CONF_DIR, exist_ok=True)
+    os.makedirs(_CONF_DIR, mode=0o750, exist_ok=True)
+    subprocess.run(['chown', 'root:www-data', _CONF_DIR], capture_output=True)
     Path(_ENV_FILE).write_text(f'MICRONAS_USER={user}\nMICRONAS_PASS_HASH={h}\n')
     os.chmod(_ENV_FILE, 0o600)
     _creds['user']  = user