diff --git a/root/etc/s6-overlay/s6-rc.d/init-permissions/run b/root/etc/s6-overlay/s6-rc.d/init-permissions/run
new file mode 100644
index 0000000..3fff167
--- /dev/null
+++ b/root/etc/s6-overlay/s6-rc.d/init-permissions/run
@@ -0,0 +1,30 @@
+#!/usr/bin/with-contenv bash
+# shellcheck shell=bash
+
+if [[ -z ${LSIO_READ_ONLY_FS} ]] && [[ -z ${LSIO_NON_ROOT_USER} ]]; then
+    # permissions
+    lsiown -R abc:abc \
+        /var/lib/nginx
+
+    chmod -R 644 /etc/logrotate.d
+fi
+
+if [[ -z ${LSIO_NON_ROOT_USER} ]]; then
+    lsiown -R abc:abc \
+        /config/keys \
+        /config/log \
+        /config/nginx \
+        /config/php
+
+    lsiown abc:abc \
+        /config/www
+fi
+
+if [[ -f "/config/log/logrotate.status" ]]; then
+    chmod 600 /config/log/logrotate.status
+fi
+
+chmod -R g+w \
+    /config/nginx
+
+true