diff --git a/roles/romm/meta/main.yml b/roles/romm/meta/main.yml
index 3344fc2..594eaea 100644
--- a/roles/romm/meta/main.yml
+++ b/roles/romm/meta/main.yml
@@ -10,10 +10,12 @@ dependencies:
       app_role_name: romm
       # romm_library_path is intentionally excluded: it's user-managed
       # external storage (often on NFS/SMB with pre-existing perms).
+      # mysql_data_path needs uid/gid 999 (mysql user inside the mariadb
+      # container) and mode 0700 (mariadb refuses world/group access).
       app_subdirectories: >-
         {{
           [romm_assets_path, romm_config_path, romm_resources_path,
-           romm_mysql_data_path]
+           {'path': romm_mysql_data_path, 'owner': 999, 'group': 999, 'mode': '0700'}]
           + ([romm_redis_data_path] if romm_redis_data_path else [])
         }}
       app_backup_subdirectories: