diff --git a/internal/cli/serverinit_postgres.go b/internal/cli/serverinit_postgres.go
index 4351f240..56c7d1ab 100644
--- a/internal/cli/serverinit_postgres.go
+++ b/internal/cli/serverinit_postgres.go
@@ -389,6 +389,15 @@ func (in *serverInit) writeDSN(dsn string) error {
 	if err := in.chown(dir, false); err != nil {
 		return err
 	}
+	// Root's, and the service's group may enter it. Its mode set too, not
+	// only on creation: a directory made 0700 for the service user (as
+	// `server add` made them) and handed to root here was one the service
+	// could no longer open, and the gateway did not start.
+	if in.user != "" {
+		if err := os.Chmod(dir, 0o750); err != nil {
+			return err
+		}
+	}
 	if err := os.WriteFile(in.dsnPath(), []byte(dsn+"\n"), 0o600); err != nil {
 		return err
 	}