diff --git a/doc/settings/configuration.md b/doc/settings/configuration.md
index cf70b938a90df3a1cb11cffee34d888e671bb2a5_ZG9jL3NldHRpbmdzL2NvbmZpZ3VyYXRpb24ubWQ=..ab269a7991a2e0851446c7918a3d457a811ce53c_ZG9jL3NldHRpbmdzL2NvbmZpZ3VyYXRpb24ubWQ= 100644
--- a/doc/settings/configuration.md
+++ b/doc/settings/configuration.md
@@ -333,6 +333,7 @@
 | `gitlab-consul`      | Only when using GitLab Consul           | GitLab Consul user/group                                              | `/var/opt/gitlab/consul`     | `/bin/sh`     |
 | `registry`           | Only when using GitLab Registry         | GitLab Registry user/group                                            | `/var/opt/gitlab/registry`   | `/bin/sh`     |
 | `mattermost`         | Only when using GitLab Mattermost       | GitLab Mattermost user/group                                          | `/var/opt/gitlab/mattermost` | `/bin/sh`     |
+| `gitlab-backup`      | Only when using `gitlab-backup-cli`     | GitLab Backup Cli User                                                | `/var/opt/gitlab/backups`    | `/bin/sh`     |
 
 To disable user and group accounts management:
 
@@ -487,7 +488,7 @@
 
 | Default location                                       | Permissions   | Ownership        | Purpose                            |
 |--------------------------------------------------------|---------------|------------------|------------------------------------|
-| `/var/opt/gitlab/git-data`                             | `0700`        | `git:git`        | Holds repositories directory       |
+| `/var/opt/gitlab/git-data`                             | `2770`        | `git:git`        | Holds repositories directory       |
 | `/var/opt/gitlab/git-data/repositories`                | `2770`        | `git:git`        | Holds Git repositories             |
 | `/var/opt/gitlab/gitlab-rails/shared`                  | `0751`        | `git:gitlab-www` | Holds large object directories     |
 | `/var/opt/gitlab/gitlab-rails/shared/artifacts`        | `0700`        | `git:git`        | Holds CI artifacts                 |
diff --git a/docker/assets/setup b/docker/assets/setup
index cf70b938a90df3a1cb11cffee34d888e671bb2a5_ZG9ja2VyL2Fzc2V0cy9zZXR1cA==..ab269a7991a2e0851446c7918a3d457a811ce53c_ZG9ja2VyL2Fzc2V0cy9zZXR1cA== 100755
--- a/docker/assets/setup
+++ b/docker/assets/setup
@@ -54,6 +54,7 @@
 groupadd -g 993 registry
 groupadd -g 992 gitlab-prometheus
 groupadd -g 991 gitlab-consul
+groupadd -g 990 gitlab-backup
 
 # Create accounts
 ## The git account is created with * as crypted password as ssh treats the account as locked if it has a ! 
@@ -66,3 +67,8 @@
 useradd -m -u 993 -g registry -m -s /bin/sh -d /var/opt/gitlab/registry registry
 useradd -m -u 992 -g gitlab-prometheus -m -s /bin/sh -d /var/opt/gitlab/prometheus gitlab-prometheus
 useradd -m -u 991 -g gitlab-consul -m -s /bin/sh -d /var/opt/gitlab/consul gitlab-consul
+useradd -m -u 990 -g gitlab-backup -m -s /bin/sh -d /var/opt/gitlab/backups gitlab-backup
+
+# The gitlab-backup user needs access to these groups for backup/restore purposes
+usermod -a -G gitlab-psql,registry,git gitlab-backup
+
diff --git a/files/gitlab-config-template/gitlab.rb.template b/files/gitlab-config-template/gitlab.rb.template
index cf70b938a90df3a1cb11cffee34d888e671bb2a5_ZmlsZXMvZ2l0bGFiLWNvbmZpZy10ZW1wbGF0ZS9naXRsYWIucmIudGVtcGxhdGU=..ab269a7991a2e0851446c7918a3d457a811ce53c_ZmlsZXMvZ2l0bGFiLWNvbmZpZy10ZW1wbGF0ZS9naXRsYWIucmIudGVtcGxhdGU= 100644
--- a/files/gitlab-config-template/gitlab.rb.template
+++ b/files/gitlab-config-template/gitlab.rb.template
@@ -3491,3 +3491,12 @@
 # crond['log_directory'] = '/var/log/gitlab/crond'
 # crond['cron_d'] = '/var/opt/gitlab/crond'
 # crond['flags'] = {}
+
+####
+# gitlab-backup-cli settings
+####
+# gitlab_backup_cli['enable'] = false
+# gitlab_backup_cli['user'] = 'gitlab-backup'
+# gitlab_backup_cli['group'] = 'gitlab-backup'
+# gitlab_backup_cli['dir'] = '/var/opt/gitlab/backups'
+# gitlab_backup_cli['additional_groups'] = %w[git gitlab-psql registry]
diff --git a/files/gitlab-cookbooks/gitaly/recipes/git_data_dirs.rb b/files/gitlab-cookbooks/gitaly/recipes/git_data_dirs.rb
index cf70b938a90df3a1cb11cffee34d888e671bb2a5_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRhbHkvcmVjaXBlcy9naXRfZGF0YV9kaXJzLnJi..ab269a7991a2e0851446c7918a3d457a811ce53c_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRhbHkvcmVjaXBlcy9naXRfZGF0YV9kaXJzLnJi 100644
--- a/files/gitlab-cookbooks/gitaly/recipes/git_data_dirs.rb
+++ b/files/gitlab-cookbooks/gitaly/recipes/git_data_dirs.rb
@@ -25,7 +25,7 @@
   storage_directory git_data_directory['path'] do
     owner gitlab_user
     group gitlab_group
-    mode "0700"
+    mode "2770"
   end
 end
 
diff --git a/files/gitlab-cookbooks/gitlab/attributes/default.rb b/files/gitlab-cookbooks/gitlab/attributes/default.rb
index cf70b938a90df3a1cb11cffee34d888e671bb2a5_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvYXR0cmlidXRlcy9kZWZhdWx0LnJi..ab269a7991a2e0851446c7918a3d457a811ce53c_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvYXR0cmlidXRlcy9kZWZhdWx0LnJi 100644
--- a/files/gitlab-cookbooks/gitlab/attributes/default.rb
+++ b/files/gitlab-cookbooks/gitlab/attributes/default.rb
@@ -1096,3 +1096,12 @@
 default['gitlab']['runtime-dir'] = Gitlab::Deprecations::NodeAttribute.new(proc { node['gitlab']['runtime_dir'] }, "node['gitlab']['runtime-dir']", "node['gitlab']['runtime_dir']")
 default['gitlab']['storage-check'] = Gitlab::Deprecations::NodeAttribute.new(proc { node['gitlab']['storage_check'].to_h }, "node['gitlab']['storage-check']", "node['gitlab']['storage_check']")
 default['gitlab']['web-server'] = Gitlab::Deprecations::NodeAttribute.new(proc { node['gitlab']['web_server'].to_h }, "node['gitlab']['web-server']", "node['gitlab']['web_server']")
+
+####
+# gitlab-backup-cli settings
+####
+default['gitlab']['gitlab_backup_cli']['enable'] = false
+default['gitlab']['gitlab_backup_cli']['user'] = 'gitlab-backup'
+default['gitlab']['gitlab_backup_cli']['group'] = 'gitlab-backup'
+default['gitlab']['gitlab_backup_cli']['dir'] = '/var/opt/gitlab/backups'
+default['gitlab']['gitlab_backup_cli']['additional_groups'] = %w[git gitlab-psql registry]
diff --git a/files/gitlab-cookbooks/gitlab/recipes/default.rb b/files/gitlab-cookbooks/gitlab/recipes/default.rb
index cf70b938a90df3a1cb11cffee34d888e671bb2a5_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9kZWZhdWx0LnJi..ab269a7991a2e0851446c7918a3d457a811ce53c_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9kZWZhdWx0LnJi 100644
--- a/files/gitlab-cookbooks/gitlab/recipes/default.rb
+++ b/files/gitlab-cookbooks/gitlab/recipes/default.rb
@@ -83,9 +83,6 @@
 # `account` custom resource will not create them.
 include_recipe "gitlab::users"
 
-# Recipe for gitlab-backup-cli tool
-include_recipe "gitlab::gitlab-backup-cli"
-
 include_recipe "gitlab::gitlab-rails" if node['gitlab']['gitlab_rails']['enable']
 
 include_recipe "gitlab::selinux"
@@ -192,6 +189,13 @@
 # Recipe which handles all prometheus related services
 include_recipe "monitoring"
 
+# Recipe for gitlab-backup-cli tool
+if node['gitlab']['gitlab_backup_cli']['enable']
+  include_recipe "gitlab::gitlab-backup-cli"
+else
+  include_recipe "gitlab::gitlab-backup-cli_disable"
+end
+
 if node['gitlab']['gitlab_rails']['database_reindexing']['enable']
   include_recipe 'gitlab::database_reindexing_enable'
 else
diff --git a/files/gitlab-cookbooks/gitlab/recipes/gitlab-backup-cli.rb b/files/gitlab-cookbooks/gitlab/recipes/gitlab-backup-cli.rb
index cf70b938a90df3a1cb11cffee34d888e671bb2a5_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItYmFja3VwLWNsaS5yYg==..ab269a7991a2e0851446c7918a3d457a811ce53c_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItYmFja3VwLWNsaS5yYg== 100644
--- a/files/gitlab-cookbooks/gitlab/recipes/gitlab-backup-cli.rb
+++ b/files/gitlab-cookbooks/gitlab/recipes/gitlab-backup-cli.rb
@@ -24,3 +24,21 @@
   source 'gitlab-backup-cli-config.yml.erb'
   sensitive true
 end
+
+account "GitLab Backup User" do
+  username node['gitlab']['gitlab_backup_cli']['user']
+  uid node['gitlab']['gitlab_backup_cli']['uid']
+  ugid node['gitlab']['gitlab_backup_cli']['group']
+  groupname node['gitlab']['gitlab_backup_cli']['group']
+  gid node['gitlab']['gitlab_backup_cli']['gid']
+  home node['gitlab']['gitlab_backup_cli']['dir']
+  manage node['gitlab']['manage_accounts']['enable']
+end
+
+node['gitlab']['gitlab_backup_cli']['additional_groups'].each do |group_name|
+  group group_name do
+    append true
+    members node['gitlab']['gitlab_backup_cli']['user']
+    action :manage
+  end
+end
diff --git a/files/gitlab-cookbooks/gitlab/recipes/gitlab-backup-cli_disable.rb b/files/gitlab-cookbooks/gitlab/recipes/gitlab-backup-cli_disable.rb
new file mode 100644
index 0000000000000000000000000000000000000000..ab269a7991a2e0851446c7918a3d457a811ce53c_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItYmFja3VwLWNsaV9kaXNhYmxlLnJi
--- /dev/null
+++ b/files/gitlab-cookbooks/gitlab/recipes/gitlab-backup-cli_disable.rb
@@ -0,0 +1,41 @@
+#
+# Copyright:: Copyright (c) 2024 GitLab Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+install_dir = node['package']['install-dir']
+gitlab_backup_cli_config_file = "#{install_dir}/etc/gitlab-backup-cli-config.yml"
+
+template gitlab_backup_cli_config_file do
+  owner 'root'
+  group 'root'
+  mode  '0644'
+  source 'gitlab-backup-cli-config.yml.erb'
+  sensitive true
+  action :delete
+end
+
+account "GitLab Backup User" do
+  username node['gitlab']['gitlab_backup_cli']['user']
+  manage node['gitlab']['manage_accounts']['enable']
+  action :remove
+end
+
+node['gitlab']['gitlab_backup_cli']['additional_groups'].each do |group_name|
+  group group_name do
+    append true
+    excluded_members node['gitlab']['gitlab_backup_cli']['user']
+    action :manage
+  end
+end
diff --git a/files/gitlab-cookbooks/package/libraries/config/gitlab.rb b/files/gitlab-cookbooks/package/libraries/config/gitlab.rb
index cf70b938a90df3a1cb11cffee34d888e671bb2a5_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9wYWNrYWdlL2xpYnJhcmllcy9jb25maWcvZ2l0bGFiLnJi..ab269a7991a2e0851446c7918a3d457a811ce53c_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9wYWNrYWdlL2xpYnJhcmllcy9jb25maWcvZ2l0bGFiLnJi 100644
--- a/files/gitlab-cookbooks/package/libraries/config/gitlab.rb
+++ b/files/gitlab-cookbooks/package/libraries/config/gitlab.rb
@@ -123,5 +123,6 @@
     attribute('high_availability')
     attribute('web_server')
     attribute('prometheus_monitoring')
+    attribute('gitlab_backup_cli')
   end
 end
diff --git a/files/gitlab-cookbooks/postgresql/recipes/enable.rb b/files/gitlab-cookbooks/postgresql/recipes/enable.rb
index cf70b938a90df3a1cb11cffee34d888e671bb2a5_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9wb3N0Z3Jlc3FsL3JlY2lwZXMvZW5hYmxlLnJi..ab269a7991a2e0851446c7918a3d457a811ce53c_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9wb3N0Z3Jlc3FsL3JlY2lwZXMvZW5hYmxlLnJi 100644
--- a/files/gitlab-cookbooks/postgresql/recipes/enable.rb
+++ b/files/gitlab-cookbooks/postgresql/recipes/enable.rb
@@ -30,7 +30,8 @@
 
 directory node['postgresql']['dir'] do
   owner postgresql_username
-  mode "0755"
+  group postgresql_group
+  mode "2775"
   recursive true
 end
 
diff --git a/files/gitlab-cookbooks/postgresql/recipes/user.rb b/files/gitlab-cookbooks/postgresql/recipes/user.rb
index cf70b938a90df3a1cb11cffee34d888e671bb2a5_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9wb3N0Z3Jlc3FsL3JlY2lwZXMvdXNlci5yYg==..ab269a7991a2e0851446c7918a3d457a811ce53c_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9wb3N0Z3Jlc3FsL3JlY2lwZXMvdXNlci5yYg== 100644
--- a/files/gitlab-cookbooks/postgresql/recipes/user.rb
+++ b/files/gitlab-cookbooks/postgresql/recipes/user.rb
@@ -32,7 +32,8 @@
 
 directory node['postgresql']['home'] do
   owner postgresql_username
-  mode "0755"
+  group postgresql_group
+  mode "2775"
   recursive true
 end
 
diff --git a/files/gitlab-cookbooks/registry/recipes/enable.rb b/files/gitlab-cookbooks/registry/recipes/enable.rb
index cf70b938a90df3a1cb11cffee34d888e671bb2a5_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9yZWdpc3RyeS9yZWNpcGVzL2VuYWJsZS5yYg==..ab269a7991a2e0851446c7918a3d457a811ce53c_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9yZWdpc3RyeS9yZWNpcGVzL2VuYWJsZS5yYg== 100644
--- a/files/gitlab-cookbooks/registry/recipes/enable.rb
+++ b/files/gitlab-cookbooks/registry/recipes/enable.rb
@@ -43,7 +43,8 @@
 directory "create #{working_dir} and set the owner" do
   path working_dir
   owner account_helper.registry_user
-  mode '0700'
+  group account_helper.registry_group
+  mode '2770'
   recursive true
 end
 
diff --git a/spec/chef/cookbooks/gitlab/recipes/gitlab-backup-cli-disable_spec.rb b/spec/chef/cookbooks/gitlab/recipes/gitlab-backup-cli-disable_spec.rb
new file mode 100644
index 0000000000000000000000000000000000000000..ab269a7991a2e0851446c7918a3d457a811ce53c_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItYmFja3VwLWNsaS1kaXNhYmxlX3NwZWMucmI=
--- /dev/null
+++ b/spec/chef/cookbooks/gitlab/recipes/gitlab-backup-cli-disable_spec.rb
@@ -0,0 +1,54 @@
+#
+# Copyright:: Copyright (c) 2024 GitLab Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require 'chef_helper'
+
+RSpec.describe 'gitlab::gitlab-backup-cli-disable' do
+  let(:chef_runner) do
+    ChefSpec::SoloRunner.new do |node|
+      node.normal['package']['install-dir'] = '/opt/gitlab'
+    end
+  end
+
+  let(:chef_run) do
+    chef_runner.converge('gitlab::default')
+  end
+
+  let(:template_path) { '/opt/gitlab/etc/gitlab-backup-cli-config.yml' }
+
+  context 'by default' do
+    it 'is included' do
+      expect(chef_run).to include_recipe('gitlab::gitlab-backup-cli_disable')
+    end
+
+    it 'removes the gitlab-backup-cli-config.yml template' do
+      expect(chef_run).to delete_template(template_path)
+    end
+
+    it 'removes the gitlab-backup user' do
+      expect(chef_run).to remove_account('GitLab Backup User')
+    end
+
+    it 'removes the gitlab-backup user from the appropriate groups' do
+      %w[git gitlab-psql registry].each do |group|
+        expect(chef_run).to manage_group(group).with(
+          excluded_members: ['gitlab-backup'],
+          append: true
+        )
+      end
+    end
+  end
+end
diff --git a/spec/chef/cookbooks/gitlab/recipes/gitlab-backup-cli_spec.rb b/spec/chef/cookbooks/gitlab/recipes/gitlab-backup-cli_spec.rb
index cf70b938a90df3a1cb11cffee34d888e671bb2a5_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItYmFja3VwLWNsaV9zcGVjLnJi..ab269a7991a2e0851446c7918a3d457a811ce53c_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItYmFja3VwLWNsaV9zcGVjLnJi 100644
--- a/spec/chef/cookbooks/gitlab/recipes/gitlab-backup-cli_spec.rb
+++ b/spec/chef/cookbooks/gitlab/recipes/gitlab-backup-cli_spec.rb
@@ -29,7 +29,9 @@
 
   let(:template_path) { '/opt/gitlab/etc/gitlab-backup-cli-config.yml' }
 
-  before do
-    allow(Gitlab).to receive(:[]).and_call_original
+  context 'by default' do
+    it 'does not run' do
+      expect(chef_run).not_to include_recipe('gitlab::gitlab-backup-cli')
+    end
   end
 
@@ -34,12 +36,44 @@
   end
 
-  it 'creates gitlab-backup-cli-config.yml template' do
-    expect(chef_run).to create_template(template_path).with(
-      owner: 'root',
-      group: 'root',
-      mode: '0644',
-      source: 'gitlab-backup-cli-config.yml.erb',
-      sensitive: true
-    )
+  context 'when enabled' do
+    before do
+      allow(Gitlab).to receive(:[]).and_call_original
+      stub_gitlab_rb(
+        gitlab_backup_cli: {
+          enable: true
+        }
+      )
+    end
+
+    it 'includes the recipe' do
+      expect(chef_run).to include_recipe('gitlab::gitlab-backup-cli')
+    end
+
+    it 'creates gitlab-backup-cli-config.yml template' do
+      expect(chef_run).to create_template(template_path).with(
+        owner: 'root',
+        group: 'root',
+        mode: '0644',
+        source: 'gitlab-backup-cli-config.yml.erb',
+        sensitive: true
+      )
+    end
+
+    it 'creates a gitlab-backup user' do
+      expect(chef_run).to create_account('GitLab Backup User').with(
+        username: 'gitlab-backup',
+        groupname: 'gitlab-backup',
+        home: '/var/opt/gitlab/backups'
+      )
+    end
+
+    it 'adds the gitlab-backup user to the appropriate groups' do
+      %w[git gitlab-psql registry].each do |group|
+        expect(chef_run).to manage_group(group).with(
+          members: ['gitlab-backup'],
+          append: true
+        )
+      end
+    end
   end
 end
diff --git a/spec/chef/cookbooks/postgresql/recipes/postgresql_spec.rb b/spec/chef/cookbooks/postgresql/recipes/postgresql_spec.rb
index cf70b938a90df3a1cb11cffee34d888e671bb2a5_c3BlYy9jaGVmL2Nvb2tib29rcy9wb3N0Z3Jlc3FsL3JlY2lwZXMvcG9zdGdyZXNxbF9zcGVjLnJi..ab269a7991a2e0851446c7918a3d457a811ce53c_c3BlYy9jaGVmL2Nvb2tib29rcy9wb3N0Z3Jlc3FsL3JlY2lwZXMvcG9zdGdyZXNxbF9zcGVjLnJi 100644
--- a/spec/chef/cookbooks/postgresql/recipes/postgresql_spec.rb
+++ b/spec/chef/cookbooks/postgresql/recipes/postgresql_spec.rb
@@ -919,7 +919,12 @@
   context 'postgresql directory' do
     context 'with default settings' do
       it 'creates postgresql directory' do
-        expect(chef_run).to create_directory('/var/opt/gitlab/postgresql').with(owner: 'gitlab-psql', mode: '0755', recursive: true)
+        expect(chef_run).to create_directory('/var/opt/gitlab/postgresql').with(
+          owner: 'gitlab-psql',
+          group: 'gitlab-psql',
+          mode: '2775',
+          recursive: true
+        )
       end
     end
 
@@ -933,7 +938,12 @@
       end
 
       it 'creates postgresql directory with custom path' do
-        expect(chef_run).to create_directory('/mypgdir').with(owner: 'gitlab-psql', mode: '0755', recursive: true)
+        expect(chef_run).to create_directory('/mypgdir').with(
+          owner: 'gitlab-psql',
+          group: 'gitlab-psql',
+          mode: '2775',
+          recursive: true
+        )
       end
     end
   end
diff --git a/spec/chef/cookbooks/postgresql/recipes/user_spec.rb b/spec/chef/cookbooks/postgresql/recipes/user_spec.rb
index cf70b938a90df3a1cb11cffee34d888e671bb2a5_c3BlYy9jaGVmL2Nvb2tib29rcy9wb3N0Z3Jlc3FsL3JlY2lwZXMvdXNlcl9zcGVjLnJi..ab269a7991a2e0851446c7918a3d457a811ce53c_c3BlYy9jaGVmL2Nvb2tib29rcy9wb3N0Z3Jlc3FsL3JlY2lwZXMvdXNlcl9zcGVjLnJi 100644
--- a/spec/chef/cookbooks/postgresql/recipes/user_spec.rb
+++ b/spec/chef/cookbooks/postgresql/recipes/user_spec.rb
@@ -26,7 +26,8 @@
     it 'creates postgresql base directory' do
       directory_params = {
         owner: 'gitlab-psql',
-        mode: '0755',
+        group: 'gitlab-psql',
+        mode: '2775',
         recursive: true
       }
       expect(chef_run).to create_directory('/var/opt/gitlab/postgresql').with(directory_params)
@@ -66,10 +67,11 @@
     it 'creates postgresql base directory' do
       directory_params = {
         owner: 'gitlab-psql',
-        mode: '0755',
+        group: 'gitlab-psql',
+        mode: '2775',
         recursive: true
       }
       expect(chef_run).to create_directory('/mypghomedir').with(directory_params)
     end
 
     it 'creates necessary directories' do
@@ -70,10 +72,15 @@
         recursive: true
       }
       expect(chef_run).to create_directory('/mypghomedir').with(directory_params)
     end
 
     it 'creates necessary directories' do
-      expect(chef_run).to create_directory('/mypghomedir').with(owner: 'gitlab-psql', mode: '0755', recursive: true)
+      expect(chef_run).to create_directory('/mypghomedir').with(
+        owner: 'gitlab-psql',
+        group: 'gitlab-psql',
+        mode: '2775',
+        recursive: true
+      )
     end
   end
 end
diff --git a/spec/chef/support/shared_examples/git_data_dirs.rb b/spec/chef/support/shared_examples/git_data_dirs.rb
index cf70b938a90df3a1cb11cffee34d888e671bb2a5_c3BlYy9jaGVmL3N1cHBvcnQvc2hhcmVkX2V4YW1wbGVzL2dpdF9kYXRhX2RpcnMucmI=..ab269a7991a2e0851446c7918a3d457a811ce53c_c3BlYy9jaGVmL3N1cHBvcnQvc2hhcmVkX2V4YW1wbGVzL2dpdF9kYXRhX2RpcnMucmI= 100644
--- a/spec/chef/support/shared_examples/git_data_dirs.rb
+++ b/spec/chef/support/shared_examples/git_data_dirs.rb
@@ -1,6 +1,6 @@
 RSpec.shared_examples 'git data directory' do |git_data_path|
   it 'creates the git-data directory' do
-    expect(chef_run).to create_storage_directory(git_data_path).with(owner: 'git', group: 'git', mode: '0700')
+    expect(chef_run).to create_storage_directory(git_data_path).with(owner: 'git', group: 'git', mode: '2770')
   end
 
   it 'creates the repositories directory' do
diff --git a/spec/chef/support/shared_examples/registry_service.rb b/spec/chef/support/shared_examples/registry_service.rb
index cf70b938a90df3a1cb11cffee34d888e671bb2a5_c3BlYy9jaGVmL3N1cHBvcnQvc2hhcmVkX2V4YW1wbGVzL3JlZ2lzdHJ5X3NlcnZpY2UucmI=..ab269a7991a2e0851446c7918a3d457a811ce53c_c3BlYy9jaGVmL3N1cHBvcnQvc2hhcmVkX2V4YW1wbGVzL3JlZ2lzdHJ5X3NlcnZpY2UucmI= 100644
--- a/spec/chef/support/shared_examples/registry_service.rb
+++ b/spec/chef/support/shared_examples/registry_service.rb
@@ -5,7 +5,11 @@
     expect(chef_run.node['gitlab']['gitlab_rails']['registry_path'])
       .to eql('/var/opt/gitlab/gitlab-rails/shared/registry')
 
-    expect(chef_run).to create_directory('/var/opt/gitlab/registry')
+    expect(chef_run).to create_directory('/var/opt/gitlab/registry').with(
+      owner: 'registry',
+      group: 'registry',
+      mode: '2770'
+    )
     expect(chef_run).to create_directory('/var/opt/gitlab/gitlab-rails/shared/registry').with(
       owner: 'registry',
       group: 'git',