diff --git a/roles/nextcloud/tasks/main.yml b/roles/nextcloud/tasks/main.yml
index 7cc03c5..820a35c 100644
--- a/roles/nextcloud/tasks/main.yml
+++ b/roles/nextcloud/tasks/main.yml
@@ -81,8 +81,11 @@
               extra_opts: [--strip-components=1]
           - name: Create data directory
             file:
-              path: "{{ nextcloud_webroot }}/data"
+              path: "/var/nextcloud"
               state: directory
+              mode: 0700
+              owner: www-data
+              group: www-data
           - name: Chown webroot
             # Nextcloud docs say Apache needs write access, so it gets write access
             file: