diff --git a/modules/services/web-servers/apache-httpd/default.nix b/modules/services/web-servers/apache-httpd/default.nix
index 04418d97b10b..ba02c6ead43f 100644
--- a/modules/services/web-servers/apache-httpd/default.nix
+++ b/modules/services/web-servers/apache-httpd/default.nix
@@ -594,7 +594,8 @@ in
 
         preStart =
           ''
-            mkdir -m 0700 -p ${mainCfg.stateDir}
+            mkdir -m 0750 -p ${mainCfg.stateDir}
+            chown root.wwwrun ${mainCfg.stateDir}
             mkdir -m 0700 -p ${mainCfg.logDir}
 
             ${optionalString (mainCfg.documentRoot != null)