diff --git a/tasks/main.yml b/tasks/main.yml
index e0b7b05..081bf94 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -8,6 +8,19 @@
     groups: grafana
     append: yes
 
+- name: ensure log file is owned by grafana and not root
+  file:
+    path: /var/log/grafana/grafana.log
+    owner: grafana
+    group: grafana
+- name: ensure data directory is owned by grafana and not root
+  file:
+    path: /var/lib/grafana
+    owner: grafana
+    group: grafana
+    state: directory
+    recurse: True
+
 - name: set admin password
   command:
     argv:
@@ -72,7 +85,7 @@
     tls_client_key: "{{ item.value.tls_client_key|d(omit) }}"
 
 - name: import dashboards
-  loop: "{{ grafana.dashboards||dict2items }}"
+  loop: "{{ grafana.dashboards|dict2items }}"
   grafana_dashboard:
     grafana_url: "http://127.0.0.1"
     grafana_user: "admin"