diff --git a/configure.ac b/configure.ac
index f69a794d7..1ae4dc8dd 100644
--- a/configure.ac
+++ b/configure.ac
@@ -384,6 +384,7 @@ AC_SUBST([IPAPLATFORM])
 AC_MSG_RESULT([${IPAPLATFORM}])
 
 if test "x${IPAPLATFORM}" == "xdebian"; then
+    HTTPD_GROUP="www-data"
     KRB5KDC_SERVICE="krb5-kdc.service"
     NAMED_GROUP="bind"
     ODS_USER="opendnssec"
@@ -391,6 +392,7 @@ if test "x${IPAPLATFORM}" == "xdebian"; then
     # see https://www.debian.org/doc/packaging-manuals/python-policy/ap-packaging_tools.html
     PYTHON_INSTALL_EXTRA_OPTIONS="--install-layout=deb"
 else
+    HTTPD_GROUP="apache"
     KRB5KDC_SERVICE="krb5kdc.service"
     NAMED_GROUP="named"
     ODS_USER="ods"
@@ -398,6 +400,10 @@ else
     PYTHON_INSTALL_EXTRA_OPTIONS=""
 fi
 
+AC_MSG_CHECKING([HTTPD_GROUP])
+AC_SUBST([HTTPD_GROUP])
+AC_MSG_RESULT([${HTTPD_GROUP}])
+
 AC_SUBST([KRB5KDC_SERVICE])
 
 AC_MSG_CHECKING([NAMED_GROUP])
diff --git a/init/tmpfilesd/Makefile.am b/init/tmpfilesd/Makefile.am
index 3ea4533ee..5d6e96f2c 100644
--- a/init/tmpfilesd/Makefile.am
+++ b/init/tmpfilesd/Makefile.am
@@ -7,4 +7,6 @@ systemdtmpfiles_DATA =         \
 CLEANFILES = $(systemdtmpfiles_DATA)
 
 %: %.in Makefile
-	cp '$(srcdir)/$@.in' $@
+	sed \
+		-e 's|@HTTPD_GROUP[@]|$(HTTPD_GROUP)|g' \
+		 '$(srcdir)/$@.in' >$@
diff --git a/init/tmpfilesd/ipa.conf.in b/init/tmpfilesd/ipa.conf.in
index 6467e1b93..e2b15aa5b 100644
--- a/init/tmpfilesd/ipa.conf.in
+++ b/init/tmpfilesd/ipa.conf.in
@@ -1,3 +1,3 @@
 d /run/ipa 0711 root root
 d /run/ipa/ccaches 6770 ipaapi ipaapi
-a+ /run/ipa/ccaches - - - - g:apache:rwx
+a+ /run/ipa/ccaches - - - - g:@HTTPD_GROUP@:rwx