diff --git a/README.md b/README.md
index 38771f6..505e537 100644
--- a/README.md
+++ b/README.md
@@ -16,6 +16,10 @@ notarius_manage_build_dependencies: true
 notarius_go_snap_channel: 1.26/stable
 notarius_go_binary: /snap/bin/go
 notarius_config_path: /usr/local/etc/notarius/config.yml
+notarius_config_owner: root
+notarius_config_group: root
+notarius_config_directory_mode: "0755"
+notarius_config_file_mode: "0644"
 notarius_config_version: 4
 notarius_promptkit_profile_dir: null
 notarius_promptkit_profile_file: null
@@ -43,10 +47,15 @@ the binary is `root:root` mode `0755`.
 Configuration variables map directly to Notarius's versioned YAML fields.
 Every optional value defaults to `null`, so it and any empty parent section are
 omitted and Notarius retains ownership of its built-in defaults. The role always
-emits `notarius_config_version` as `version` and writes the file as `root:root`
-mode `0644`. `notarius_pipelines` is the native mapping supplied by the caller;
-the role does not merge or rewrite it. For example, inventory can compose
-fragments in the ordinary way:
+emits `notarius_config_version` as `version`. It manages
+`notarius_config_path | dirname` and the resulting file with
+`notarius_config_owner`, `notarius_config_group`,
+`notarius_config_directory_mode`, and `notarius_config_file_mode`. The
+standalone defaults are `root:root`, directory mode `0755`, and file mode
+`0644`; composing roles may override this generic configuration interface.
+`notarius_pipelines` is the native mapping supplied by the caller; the role
+does not merge or rewrite it. For example, inventory can compose fragments in
+the ordinary way:
 
 ```yaml
 notarius_pipelines: "{{ notarius_pipeline_group_one | combine(notarius_pipeline_group_two) }}"
diff --git a/defaults/main.yml b/defaults/main.yml
index 1d5184f..ec5d406 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -7,6 +7,10 @@ notarius_manage_build_dependencies: true
 notarius_go_snap_channel: 1.26/stable
 notarius_go_binary: /snap/bin/go
 notarius_config_path: /usr/local/etc/notarius/config.yml
+notarius_config_owner: root
+notarius_config_group: root
+notarius_config_directory_mode: "0755"
+notarius_config_file_mode: "0644"
 notarius_config_version: 4
 notarius_promptkit_profile_dir: null
 notarius_promptkit_profile_file: null
diff --git a/meta/argument_specs.yml b/meta/argument_specs.yml
index 5b66c1c..cb34c20 100644
--- a/meta/argument_specs.yml
+++ b/meta/argument_specs.yml
@@ -27,6 +27,18 @@ argument_specs:
       notarius_config_path:
         type: path
         required: true
+      notarius_config_owner:
+        type: str
+        required: true
+      notarius_config_group:
+        type: str
+        required: true
+      notarius_config_directory_mode:
+        type: str
+        required: true
+      notarius_config_file_mode:
+        type: str
+        required: true
       notarius_config_version:
         type: int
         required: true
diff --git a/tasks/main.yml b/tasks/main.yml
index 595c8b4..f436c7e 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -36,7 +36,15 @@
   loop:
     - "{{ notarius_source_dir | dirname }}"
     - "{{ notarius_binary_path | dirname }}"
-    - "{{ notarius_config_path | dirname }}"
+
+- name: Create the Notarius configuration directory
+  become: true
+  ansible.builtin.file:
+    path: "{{ notarius_config_path | dirname }}"
+    state: directory
+    owner: "{{ notarius_config_owner }}"
+    group: "{{ notarius_config_group }}"
+    mode: "{{ notarius_config_directory_mode }}"
 
 - name: Check out Notarius source
   become: true
@@ -96,6 +104,6 @@
   ansible.builtin.template:
     src: config.yml.j2
     dest: "{{ notarius_config_path }}"
-    owner: root
-    group: root
-    mode: "0644"
+    owner: "{{ notarius_config_owner }}"
+    group: "{{ notarius_config_group }}"
+    mode: "{{ notarius_config_file_mode }}"