diff --git a/server/Server.js b/server/Server.js
index 7e14296d..ed680a6f 100644
--- a/server/Server.js
+++ b/server/Server.js
@@ -10,6 +10,7 @@ const { version } = require('../package.json')
 
 // Utils
 const dbMigration = require('./utils/dbMigration')
+const filePerms = require('./utils/filePerms')
 const Logger = require('./Logger')
 
 // Classes
@@ -46,9 +47,18 @@ class Server {
       global.MetadataPath = global.MetadataPath.replace(/\\/g, '/')
     }
 
-    fs.ensureDirSync(global.ConfigPath, 0o774)
-    fs.ensureDirSync(global.MetadataPath, 0o774)
-    fs.ensureDirSync(global.AudiobookPath, 0o774)
+    if (!fs.pathExistsSync(global.ConfigPath)) {
+      fs.mkdirSync(global.ConfigPath)
+      filePerms.setDefaultDirSync(global.ConfigPath, false)
+    }
+    if (!fs.pathExistsSync(global.MetadataPath)) {
+      fs.mkdirSync(global.MetadataPath)
+      filePerms.setDefaultDirSync(global.MetadataPath, false)
+    }
+    if (!fs.pathExistsSync(global.AudiobookPath)) {
+      fs.mkdirSync(global.AudiobookPath)
+      filePerms.setDefaultDirSync(global.AudiobookPath, false)
+    }
 
     this.db = new Db()
     this.watcher = new Watcher()
diff --git a/server/managers/CoverManager.js b/server/managers/CoverManager.js
index b0bcab58..0dfdfdce 100644
--- a/server/managers/CoverManager.js
+++ b/server/managers/CoverManager.js
@@ -113,6 +113,7 @@ class CoverManager {
 
     Logger.info(`[CoverManager] Uploaded libraryItem cover "${coverFullPath}" for "${libraryItem.media.metadata.title}"`)
 
+    await filePerms.setDefault(coverFullPath)
     libraryItem.updateMediaCover(coverFullPath)
     return {
       cover: coverFullPath
@@ -151,6 +152,7 @@ class CoverManager {
 
       Logger.info(`[CoverManager] Downloaded libraryItem cover "${coverFullPath}" from url "${url}" for "${libraryItem.media.metadata.title}"`)
 
+      await filePerms.setDefault(coverFullPath)
       libraryItem.updateMediaCover(coverFullPath)
       return {
         cover: coverFullPath
@@ -250,6 +252,8 @@ class CoverManager {
 
     var success = await extractCoverArt(audioFileWithCover.metadata.path, coverFilePath)
     if (success) {
+      await filePerms.setDefault(coverFilePath)
+
       libraryItem.updateMediaCover(coverFilePath)
       return coverFilePath
     }
diff --git a/server/utils/filePerms.js b/server/utils/filePerms.js
index 1a511bb4..07c7331a 100644
--- a/server/utils/filePerms.js
+++ b/server/utils/filePerms.js
@@ -94,4 +94,21 @@ module.exports.setDefault = (path, silent = false) => {
     if (!silent) Logger.debug(`[FilePerms] Setting permission "${mode}" for uid ${uid} and gid ${gid} | "${path}"`)
     chmodr(path, mode, uid, gid, resolve)
   })
+}
+
+// Default permissions 0o744 and global Uid/Gid
+//  Used for setting default permission to initial config/metadata directories
+module.exports.setDefaultDirSync = (path, silent = false) => {
+  const mode = 0o744
+  const uid = global.Uid
+  const gid = global.Gid
+  if (!silent) Logger.debug(`[FilePerms] Setting dir permission "${mode}" for uid ${uid} and gid ${gid} | "${path}"`)
+  try {
+    fs.chmodSync(path, mode)
+    fs.chownSync(path, uid, gid)
+    return true
+  } catch (error) {
+    Logger.error(`[FilePerms] Error setting dir permissions for path "${path}"`, error)
+    return false
+  }
 }
\ No newline at end of file