diff --git a/README.md b/README.md
index 2e534b7..5b3cfd5 100644
--- a/README.md
+++ b/README.md
@@ -16,6 +16,10 @@ scriptorium_manage_build_dependencies: true
 scriptorium_go_snap_channel: 1.26/stable
 scriptorium_go_binary: /snap/bin/go
 scriptorium_config_path: /usr/local/etc/scriptorium/config.yml
+scriptorium_config_owner: root
+scriptorium_config_group: root
+scriptorium_config_directory_mode: "0755"
+scriptorium_config_file_mode: "0644"
 scriptorium_prompt_dir: null
 scriptorium_profile_dir: null
 scriptorium_schema_dir: null
@@ -40,10 +44,14 @@ binary is `root:root` mode `0755`.
 Every application configuration variable defaults to `null`, so it and any
 empty parent section are omitted and Scriptorium retains ownership of its
 built-in defaults. When no values are selected, the role writes `{}` to
-`scriptorium_config_path` as `root:root` mode `0644`. Non-null falsey values
-are retained. `scriptorium_backends` is the native mapping supplied by the
-caller; the role does not merge or rewrite it. For example, inventory can
-compose fragments in the ordinary way:
+`scriptorium_config_path`. It manages that file and its parent directory with
+`scriptorium_config_owner`, `scriptorium_config_group`,
+`scriptorium_config_directory_mode`, and `scriptorium_config_file_mode`. The
+standalone defaults are `root:root`, directory mode `0755`, and file mode
+`0644`; composing roles may override this generic configuration interface.
+Non-null falsey values are retained. `scriptorium_backends` is the native
+mapping supplied by the caller; the role does not merge or rewrite it. For
+example, inventory can compose fragments in the ordinary way:
 
 ```yaml
 scriptorium_backends: "{{ scriptorium_local_backends | combine(scriptorium_remote_backends) }}"
diff --git a/defaults/main.yml b/defaults/main.yml
index 3097d5c..a1578d4 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -7,6 +7,10 @@ scriptorium_manage_build_dependencies: true
 scriptorium_go_snap_channel: 1.26/stable
 scriptorium_go_binary: /snap/bin/go
 scriptorium_config_path: /usr/local/etc/scriptorium/config.yml
+scriptorium_config_owner: root
+scriptorium_config_group: root
+scriptorium_config_directory_mode: "0755"
+scriptorium_config_file_mode: "0644"
 scriptorium_prompt_dir: null
 scriptorium_profile_dir: null
 scriptorium_schema_dir: null
diff --git a/meta/argument_specs.yml b/meta/argument_specs.yml
index 77cdd75..427bb44 100644
--- a/meta/argument_specs.yml
+++ b/meta/argument_specs.yml
@@ -27,6 +27,18 @@ argument_specs:
       scriptorium_config_path:
         type: path
         required: true
+      scriptorium_config_owner:
+        type: str
+        required: true
+      scriptorium_config_group:
+        type: str
+        required: true
+      scriptorium_config_directory_mode:
+        type: str
+        required: true
+      scriptorium_config_file_mode:
+        type: str
+        required: true
       scriptorium_prompt_dir:
         type: path
         required: false
diff --git a/tasks/main.yml b/tasks/main.yml
index 0fbfc7b..8d0be87 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -36,7 +36,15 @@
   loop:
     - "{{ scriptorium_source_dir | dirname }}"
     - "{{ scriptorium_binary_path | dirname }}"
-    - "{{ scriptorium_config_path | dirname }}"
+
+- name: Create the Scriptorium configuration directory
+  become: true
+  ansible.builtin.file:
+    path: "{{ scriptorium_config_path | dirname }}"
+    state: directory
+    owner: "{{ scriptorium_config_owner }}"
+    group: "{{ scriptorium_config_group }}"
+    mode: "{{ scriptorium_config_directory_mode }}"
 
 - name: Check out Scriptorium source
   become: true
@@ -96,6 +104,6 @@
   ansible.builtin.template:
     src: config.yml.j2
     dest: "{{ scriptorium_config_path }}"
-    owner: root
-    group: root
-    mode: "0644"
+    owner: "{{ scriptorium_config_owner }}"
+    group: "{{ scriptorium_config_group }}"
+    mode: "{{ scriptorium_config_file_mode }}"