diff --git a/changelogs/unreleased/5090.yml b/changelogs/unreleased/5090.yml
new file mode 100644
index 0000000000000000000000000000000000000000..cccc737432c38cb529415f5291c930ce5557f2fe_Y2hhbmdlbG9ncy91bnJlbGVhc2VkLzUwOTAueW1s
--- /dev/null
+++ b/changelogs/unreleased/5090.yml
@@ -0,0 +1,5 @@
+---
+title: Explicitly set group for GitLab data directories
+merge_request: 5090
+author: Ben Bodenmiller (@bbodenmiller)
+type: other
diff --git a/doc/settings/configuration.md b/doc/settings/configuration.md
index 9fd46b304f402fe9bea435714a759fd73e24dac1_ZG9jL3NldHRpbmdzL2NvbmZpZ3VyYXRpb24ubWQ=..cccc737432c38cb529415f5291c930ce5557f2fe_ZG9jL3NldHRpbmdzL2NvbmZpZ3VyYXRpb24ubWQ= 100644
--- a/doc/settings/configuration.md
+++ b/doc/settings/configuration.md
@@ -512,6 +512,6 @@
 
 | Default location                                       | Permissions | Ownership        | Purpose |
 |--------------------------------------------------------|-------------|------------------|---------|
-| `/var/opt/gitlab/git-data`                             | `0700`        | `git`            | Holds repositories directory |
+| `/var/opt/gitlab/git-data`                             | `0700`        | `git:git`        | Holds repositories directory |
 | `/var/opt/gitlab/git-data/repositories`                | `2770`        | `git:git`        | Holds Git repositories |
 | `/var/opt/gitlab/gitlab-rails/shared`                  | `0751`        | `git:gitlab-www` | Holds large object directories |
@@ -516,9 +516,9 @@
 | `/var/opt/gitlab/git-data/repositories`                | `2770`        | `git:git`        | Holds Git repositories |
 | `/var/opt/gitlab/gitlab-rails/shared`                  | `0751`        | `git:gitlab-www` | Holds large object directories |
-| `/var/opt/gitlab/gitlab-rails/shared/artifacts`        | `0700`        | `git`            | Holds CI artifacts |
-| `/var/opt/gitlab/gitlab-rails/shared/external-diffs`   | `0700`        | `git`            | Holds external merge request diffs |
-| `/var/opt/gitlab/gitlab-rails/shared/lfs-objects`      | `0700`        | `git`            | Holds LFS objects |
-| `/var/opt/gitlab/gitlab-rails/shared/packages`         | `0700`        | `git`            | Holds package repository |
-| `/var/opt/gitlab/gitlab-rails/shared/dependency_proxy` | `0700`        | `git`            | Holds dependency proxy |
-| `/var/opt/gitlab/gitlab-rails/shared/terraform_state`  | `0700`        | `git`            | Holds terraform state |
+| `/var/opt/gitlab/gitlab-rails/shared/artifacts`        | `0700`        | `git:git`        | Holds CI artifacts |
+| `/var/opt/gitlab/gitlab-rails/shared/external-diffs`   | `0700`        | `git:git`        | Holds external merge request diffs |
+| `/var/opt/gitlab/gitlab-rails/shared/lfs-objects`      | `0700`        | `git:git`        | Holds LFS objects |
+| `/var/opt/gitlab/gitlab-rails/shared/packages`         | `0700`        | `git:git`        | Holds package repository |
+| `/var/opt/gitlab/gitlab-rails/shared/dependency_proxy` | `0700`        | `git:git`        | Holds dependency proxy |
+| `/var/opt/gitlab/gitlab-rails/shared/terraform_state`  | `0700`        | `git:git`        | Holds terraform state |
 | `/var/opt/gitlab/gitlab-rails/shared/pages`            | `0750`        | `git:gitlab-www` | Holds user pages |
@@ -524,6 +524,6 @@
 | `/var/opt/gitlab/gitlab-rails/shared/pages`            | `0750`        | `git:gitlab-www` | Holds user pages |
-| `/var/opt/gitlab/gitlab-rails/uploads`                 | `0700`        | `git`            | Holds user attachments |
-| `/var/opt/gitlab/gitlab-ci/builds`                     | `0700`        | `git`            | Holds CI build logs |
+| `/var/opt/gitlab/gitlab-rails/uploads`                 | `0700`        | `git:git`        | Holds user attachments |
+| `/var/opt/gitlab/gitlab-ci/builds`                     | `0700`        | `git:git`        | Holds CI build logs |
 | `/var/opt/gitlab/.ssh`                                 | `0700`        | `git:git`        | Holds authorized keys |
 
 ## Only start Omnibus GitLab services after a given file system is mounted
diff --git a/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb b/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb
index 9fd46b304f402fe9bea435714a759fd73e24dac1_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItcmFpbHMucmI=..cccc737432c38cb529415f5291c930ce5557f2fe_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItcmFpbHMucmI= 100644
--- a/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb
+++ b/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb
@@ -46,6 +46,7 @@
 Mash.new(Gitlab['git_data_dirs']).each do |_name, git_data_directory|
   storage_directory git_data_directory['path'] do
     owner gitlab_user
+    group gitlab_group
     mode "0700"
   end
 end
@@ -78,9 +79,10 @@
 ].compact.each do |dir_name|
   storage_directory dir_name do
     owner gitlab_user
+    group gitlab_group
     mode '0700'
   end
 end
 
 storage_directory gitlab_rails_uploads_storage_path do
   owner gitlab_user
@@ -81,9 +83,10 @@
     mode '0700'
   end
 end
 
 storage_directory gitlab_rails_uploads_storage_path do
   owner gitlab_user
+  group gitlab_group
   mode '0700'
   only_if { gitlab_rails_uploads_storage_path != GitlabRails.public_path }
 end
diff --git a/spec/chef/recipes/gitlab-rails_spec.rb b/spec/chef/recipes/gitlab-rails_spec.rb
index 9fd46b304f402fe9bea435714a759fd73e24dac1_c3BlYy9jaGVmL3JlY2lwZXMvZ2l0bGFiLXJhaWxzX3NwZWMucmI=..cccc737432c38cb529415f5291c930ce5557f2fe_c3BlYy9jaGVmL3JlY2lwZXMvZ2l0bGFiLXJhaWxzX3NwZWMucmI= 100644
--- a/spec/chef/recipes/gitlab-rails_spec.rb
+++ b/spec/chef/recipes/gitlab-rails_spec.rb
@@ -111,7 +111,7 @@
     end
 
     it 'does not create the ci builds directory' do
-      expect(chef_run).not_to run_ruby_block('directory resource: /tmp/uploads_storage')
+      expect(chef_run).not_to run_ruby_block('directory resource: /tmp/builds')
     end
 
     it 'does not create the uploads storage directory' do
@@ -137,7 +137,7 @@
     end
 
     it 'creates the git-data directory' do
-      expect(chef_run).to create_storage_directory('/tmp/git-data').with(owner: 'git', mode: '0700')
+      expect(chef_run).to create_storage_directory('/tmp/git-data').with(owner: 'git', group: 'git', mode: '0700')
     end
 
     it 'creates the repositories directory' do
@@ -149,7 +149,7 @@
     end
 
     it 'creates the artifacts directory' do
-      expect(chef_run).to create_storage_directory('/tmp/shared/artifacts').with(owner: 'git', mode: '0700')
+      expect(chef_run).to create_storage_directory('/tmp/shared/artifacts').with(owner: 'git', group: 'git', mode: '0700')
     end
 
     it 'creates the external-diffs directory' do
@@ -153,7 +153,7 @@
     end
 
     it 'creates the external-diffs directory' do
-      expect(chef_run).to create_storage_directory('/tmp/shared/external-diffs').with(owner: 'git', mode: '0700')
+      expect(chef_run).to create_storage_directory('/tmp/shared/external-diffs').with(owner: 'git', group: 'git', mode: '0700')
     end
 
     it 'creates the lfs storage directory' do
@@ -157,7 +157,7 @@
     end
 
     it 'creates the lfs storage directory' do
-      expect(chef_run).to create_storage_directory('/tmp/shared/lfs-objects').with(owner: 'git', mode: '0700')
+      expect(chef_run).to create_storage_directory('/tmp/shared/lfs-objects').with(owner: 'git', group: 'git', mode: '0700')
     end
 
     it 'creates the packages directory' do
@@ -161,7 +161,7 @@
     end
 
     it 'creates the packages directory' do
-      expect(chef_run).to create_storage_directory('/tmp/shared/packages').with(owner: 'git', mode: '0700')
+      expect(chef_run).to create_storage_directory('/tmp/shared/packages').with(owner: 'git', group: 'git', mode: '0700')
     end
 
     it 'creates the dependency_proxy directory' do
@@ -165,7 +165,7 @@
     end
 
     it 'creates the dependency_proxy directory' do
-      expect(chef_run).to create_storage_directory('/tmp/shared/dependency_proxy').with(owner: 'git', mode: '0700')
+      expect(chef_run).to create_storage_directory('/tmp/shared/dependency_proxy').with(owner: 'git', group: 'git', mode: '0700')
     end
 
     it 'creates the terraform_state directory' do
@@ -169,7 +169,7 @@
     end
 
     it 'creates the terraform_state directory' do
-      expect(chef_run).to create_storage_directory('/tmp/shared/terraform_state').with(owner: 'git', mode: '0700')
+      expect(chef_run).to create_storage_directory('/tmp/shared/terraform_state').with(owner: 'git', group: 'git', mode: '0700')
     end
 
     it 'creates the encrypted_settings directory' do
@@ -173,7 +173,7 @@
     end
 
     it 'creates the encrypted_settings directory' do
-      expect(chef_run).to create_storage_directory('/tmp/shared/encrypted_settings').with(owner: 'git', mode: '0700')
+      expect(chef_run).to create_storage_directory('/tmp/shared/encrypted_settings').with(owner: 'git', group: 'git', mode: '0700')
     end
 
     it 'creates the GitLab pages directory' do
@@ -181,7 +181,7 @@
     end
 
     it 'creates the shared tmp directory' do
-      expect(chef_run).to create_storage_directory('/tmp/shared/tmp').with(owner: 'git', mode: '0700')
+      expect(chef_run).to create_storage_directory('/tmp/shared/tmp').with(owner: 'git', group: 'git', mode: '0700')
     end
 
     it 'creates the shared cache directory' do
@@ -185,7 +185,7 @@
     end
 
     it 'creates the shared cache directory' do
-      expect(chef_run).to create_storage_directory('/tmp/shared/cache').with(owner: 'git', mode: '0700')
+      expect(chef_run).to create_storage_directory('/tmp/shared/cache').with(owner: 'git', group: 'git', mode: '0700')
     end
 
     it 'creates the uploads directory' do
@@ -189,7 +189,7 @@
     end
 
     it 'creates the uploads directory' do
-      expect(chef_run).to create_storage_directory('/tmp/uploads').with(owner: 'git', mode: '0700')
+      expect(chef_run).to create_storage_directory('/tmp/uploads').with(owner: 'git', group: 'git', mode: '0700')
     end
 
     it 'creates the ci builds directory' do
@@ -193,7 +193,7 @@
     end
 
     it 'creates the ci builds directory' do
-      expect(chef_run).to create_storage_directory('/tmp/builds').with(owner: 'git', mode: '0700')
+      expect(chef_run).to create_storage_directory('/tmp/builds').with(owner: 'git', group: 'git', mode: '0700')
     end
 
     it 'creates the uploads storage directory' do
@@ -197,7 +197,7 @@
     end
 
     it 'creates the uploads storage directory' do
-      expect(chef_run).to create_storage_directory('/tmp/uploads_storage').with(owner: 'git', mode: '0700')
+      expect(chef_run).to create_storage_directory('/tmp/uploads_storage').with(owner: 'git', group: 'git', mode: '0700')
     end
   end