diff --git a/roles/postgres/tasks/main.yml b/roles/postgres/tasks/main.yml
index e2c1986..455537e 100644
--- a/roles/postgres/tasks/main.yml
+++ b/roles/postgres/tasks/main.yml
@@ -34,25 +34,41 @@
   shell: "pg_ctlcluster {{ pg_version }} {{ pg_cluster }} stop"
   ignore_errors: true
 
+# --- Ensure data directory exists ---
+- name: Create PostgreSQL data directory
+  file:
+    path: "{{ pg_data_path }}"
+    state: directory
+    owner: postgres
+    group: postgres
+    mode: "0700"
+
+# --- Ensure cluster exists ---
+- name: Ensure PostgreSQL cluster exists
+  shell: "pg_createcluster {{ pg_version }} {{ pg_cluster }}"
+  ignore_errors: true
+
 # --- Configure PostgreSQL ---
 - name: postgresql.conf
   template:
     src: postgresql.conf.j2
     dest: "{{ pg_cluster_path }}/postgresql.conf"
+    owner: postgres
+    group: postgres
+    mode: "0600"
 
 - name: pg_hba.conf
   template:
     src: pg_hba.conf.j2
     dest: "{{ pg_cluster_path }}/pg_hba.conf"
+    owner: postgres
+    group: postgres
+    mode: "0600"
 
-# --- Ensure cluster exists and started ---
-- name: Ensure PostgreSQL cluster exists
-  shell: |
-    if [ ! -d "{{ pg_data_path }}" ]; then
-      pg_createcluster {{ pg_version }} {{ pg_cluster }} --start
-    else
-      pg_ctlcluster {{ pg_version }} {{ pg_cluster }} start
-    fi
+# --- Start cluster ---
+- name: Start PostgreSQL cluster
+  shell: "pg_ctlcluster {{ pg_version }} {{ pg_cluster }} start"
+  ignore_errors: true
 
 # --- Wait for socket to be ready ---
 - name: Wait for PostgreSQL socket