diff --git a/distros/debian8/rules b/distros/debian8/rules
index cab30b021..1f65a927f 100755
--- a/distros/debian8/rules
+++ b/distros/debian8/rules
@@ -110,7 +110,10 @@ override_dh_install:
 
 override_dh_fixperms:
 	dh_fixperms
-	chown root:root debian/zoneminder/etc/zm/zm.conf
+	#
+	# As requested by the Debian Webapps Policy Manual §3.2.1
+	chown root:www-data debian/zoneminder/etc/zm/zm.conf
+	chmod 640 debian/zoneminder/etc/zm/zm.conf
 
 override_dh_auto_test:
 	# do not run tests...
diff --git a/distros/debian8/zoneminder.postinst b/distros/debian8/zoneminder.postinst
index 712b83d15..882810a83 100644
--- a/distros/debian8/zoneminder.postinst
+++ b/distros/debian8/zoneminder.postinst
@@ -130,6 +130,9 @@ if [ "$1" = "configure" ] || [ "$1" = "reconfigure" ]; then
     if [ -z "$2" ]; then
         chown $ZM_WEB_USER:$ZM_WEB_GROUP -R /var/cache/zoneminder
     fi
+    # As requested by the Debian Webapps Policy Manual §3.2.1
+    chown root:$ZM_WEB_GROUP /etc/zm/zm.conf
+    chmod 640 /etc/zm/zm.conf
 
     # Configure the web server
     db_get zoneminder/webserver