diff --git a/entrypoint.sh b/entrypoint.sh
index 2ccefac..4d6001a 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -116,7 +116,7 @@ legacy_compat() {
     fi
     if [ -f "${LEGACY_KEYS_DIR}/provider-info.txt" ] && [ -f "${LEGACY_KEYS_DIR}/provider_name" ]; then
         echo "Using [${LEGACY_KEYS_DIR}] for keys" >&2
-        mkdir -p "${KEYS_DIR}"
+        mkdir -p -m 755 "${KEYS_DIR}"
         mv -f "${KEYS_DIR}/provider-info.txt" "${KEYS_DIR}/provider-info.txt.migrated" 2>/dev/null || :
         ln -s "${LEGACY_KEYS_DIR}/provider-info.txt" "${KEYS_DIR}/provider-info.txt" 2>/dev/null || :
         mv -f "${KEYS_DIR}/provider_name" "${KEYS_DIR}/provider_name.migrated" 2>/dev/null || :
@@ -124,16 +124,16 @@ legacy_compat() {
         mv -f "${KEYS_DIR}/secret.key" "${KEYS_DIR}/secret.key.migrated" 2>/dev/null || :
         ln -s "${LEGACY_KEYS_DIR}/secret.key" "${KEYS_DIR}/secret.key" 2>/dev/null || :
         mkdir -p -m 700 "${LEGACY_STATE_DIR}"
-        chown _encrypted-dns:_encrypted-dns "${LEGACY_STATE_DIR}"
+        chown _encrypted-dns:_encrypted-dns "${KEYS_DIR}" "${STATE_DIR}" "${LEGACY_STATE_DIR}"
         mv -f "$STATE_DIR" "${STATE_DIR}.migrated" 2>/dev/null || :
         ln -s "$LEGACY_STATE_DIR" "${STATE_DIR}" 2>/dev/null || :
     fi
     if [ -f "${LEGACY_LISTS_DIR}/blacklist.txt" ]; then
         echo "Using [${LEGACY_LISTS_DIR}] for lists" >&2
-        mkdir -p "${LISTS_DIR}"
+        mkdir -p -m 755 "${LISTS_DIR}"
         mv -f "${LISTS_DIR}/blacklist.txt" "${LISTS_DIR}/blacklist.txt.migrated" 2>/dev/null || :
         ln -s "${LEGACY_LISTS_DIR}/blacklist.txt" "${LISTS_DIR}/blacklist.txt" 2>/dev/null || :
-        chown _encrypted-dns:_encrypted-dns "${LEGACY_LISTS_DIR}/blacklist.txt"
+        chown _encrypted-dns:_encrypted-dns "${LISTS_DIR}" "${LEGACY_LISTS_DIR}/blacklist.txt"
     fi
 }