diff --git a/roles/app/defaults/main.yml b/roles/app/defaults/main.yml
index 3e10242..08f3092 100644
--- a/roles/app/defaults/main.yml
+++ b/roles/app/defaults/main.yml
@@ -2,7 +2,8 @@
 app_dir: "{{ host_root_path }}/{{ app_name }}"
 app_uid: "{{ ansible_facts.user_uid }}"
 app_gid: "{{ ansible_facts.user_gid }}"
-app_permission_mode: "0640"
+app_permission_mode: "0640"    # files (compose.yml, rendered templates)
+app_dir_mode: "0755"           # directories (app_dir and app_subdirectories)
 app_restart_policy: unless-stopped
 
 app_backup_path: "{{ backup_path }}/{{ app_name }}"
diff --git a/roles/app/tasks/setup.yml b/roles/app/tasks/setup.yml
index 7c0bea0..f47568f 100644
--- a/roles/app/tasks/setup.yml
+++ b/roles/app/tasks/setup.yml
@@ -72,15 +72,21 @@
         state: directory
         owner: "{{ app_uid }}"
         group: "{{ app_gid }}"
-        mode: "{{ app_permission_mode }}"
+        mode: "{{ app_dir_mode }}"
 
+    # Items may be plain path strings, or dicts with per-item overrides:
+    #   - /some/path                                  # uses app_uid/app_gid/app_dir_mode
+    #   - path: /some/path                            # same
+    #     owner: 999                                  # per-item overrides for containers
+    #     group: 999                                  # that expect a specific uid/gid
+    #     mode: "0700"
     - name: Create application subdirectories
       ansible.builtin.file:
-        path: "{{ item }}"
+        path: "{{ item.path | default(item) }}"
         state: directory
-        owner: "{{ app_uid }}"
-        group: "{{ app_gid }}"
-        mode: "{{ app_permission_mode }}"
+        owner: "{{ item.owner | default(app_uid) }}"
+        group: "{{ item.group | default(app_gid) }}"
+        mode: "{{ item.mode | default(app_dir_mode) }}"
       loop: "{{ app_subdirectories }}"
   tags: [setup, deploy]