diff --git a/docs/book/v1/installation/faq.md b/docs/book/v1/installation/faq.md
index 3e6c085..b173cc5 100644
--- a/docs/book/v1/installation/faq.md
+++ b/docs/book/v1/installation/faq.md
@@ -10,10 +10,11 @@ If running your project you encounter some permission issues, follow the below s
 
 > PHP Fatal error:  Uncaught InvalidArgumentException: The directory "/var/www/_example.local_/html/data/cache" is not writable...
 
-**Fix:**
+**Fix:** give the web-server user write access through the group, rather than opening the folder to everyone.
 
 ```shell
-chmod -R 777 data
+sudo chown -R "$USER":www-data data
+sudo chmod -R 775 data
 ```
 
 ### Error
@@ -23,5 +24,11 @@ chmod -R 777 data
 **Fix:**
 
 ```shell
-chmod -R 777 log
+sudo chown -R "$USER":www-data log
+sudo chmod -R 775 log
 ```
+
+> Replace `www-data` with the user your web server runs as if it differs — it is `apache` on AlmaLinux and RHEL derivatives, and `nginx` where nginx runs the worker processes.
+
+> `chmod -R 777` is sometimes suggested for these folders.
+> Avoid it outside a throwaway local VM: it lets anything on the machine rewrite the Twig and config caches, and those are executable PHP.
diff --git a/docs/book/v1/installation/running-the-application.md b/docs/book/v1/installation/running-the-application.md
index ab3c4f9..b61d97a 100644
--- a/docs/book/v1/installation/running-the-application.md
+++ b/docs/book/v1/installation/running-the-application.md
@@ -7,16 +7,11 @@ We recommend running the application on **AlmaLinux 10**, using **WSL 2**:
     - install [AlmaLinux 10](https://docs.dotkernel.org/development/v2/setup/installation/)
 - install the application in a virtualhost as recommended by the chosen distro
 - set `$baseUrl` in **config/autoload/local.php** to the address of the virtualhost
-- set the permissions for the `data` folder
+- give the web server write access to the `data` and `log` folders
 
 ```shell
-chmod -R 777 ./data
-```
-
-- set the permissions for the log folder
-
-```shell
-chmod -R 777 ./log
+sudo chown -R "$USER":www-data data log
+sudo chmod -R 775 data log
 ```
 
 - run the application by opening the virtualhost address in your browser
@@ -26,7 +21,10 @@ You should see the `Dotkernel Light` welcome page.
 > If you are getting exceptions or errors regarding some missing services, try running the following command:
 
 ```shell
-sudo php ./bin/clear-config-cache.php
+composer clear-config-cache
 ```
 
+Do not run this with `sudo`.
+Doing so leaves the regenerated `data/cache/config-cache.php` owned by root, which the application can no longer rewrite — the permission errors the [FAQ](faq.md) exists to fix.
+
 > If `data/cache/config-cache.php` is present, that config will be loaded regardless of the `ConfigAggregator::ENABLE_CACHE` configuration in `config/autoload/mezzio.global.php`