diff -r eeacb8332051 -r 073a75bf07fb deploy/provision.d/115-other-dirs.sh
--- /dev/null
+++ b/deploy/provision.d/115-other-dirs.sh
@@ -0,0 +1,31 @@
+#!/bin/bash
+
+set -e
+
+# Initialise directories used as targets for cron activity (if they
+# don't already exist)
+
+# Reminder: the webapp directory is owned and run by the code user, in
+# group www-data. The repos and other things served directly are
+# usually the other way around -- owned by the www-data user, in group
+# code. I don't recall whether there is a good reason for this.
+
+for dir in \
+    /var/files/backups \
+    /var/doc \
+    /var/files/git-mirror ; do
+    if [ ! -d "$dir" ]; then
+        mkdir -p "$dir"
+        chown -R code.www-data "$dir"
+        chmod g+s "$dir"
+    fi
+done
+
+for dir in \
+    /var/mirror ; do
+    if [ ! -d "$dir" ]; then
+        mkdir -p "$dir"
+        chown -R www-data.code "$dir"
+        chmod g+s "$dir"
+    fi
+done
diff -r eeacb8332051 -r 073a75bf07fb deploy/provision.d/140-cron.sh
--- a/deploy/provision.d/140-cron.sh
+++ b/deploy/provision.d/140-cron.sh
@@ -2,20 +2,6 @@
 
 set -e
 
-# Initialise directories used as targets for cron activity (if they
-# don't already exist)
-
-for dir in \
-    /var/files/backups \
-    /var/doc \
-    /var/files/git-mirror ; do
-    if [ ! -d "$dir" ]; then
-        mkdir -p "$dir"
-        chown -R code.www-data "$dir"
-        chmod g+s "$dir"
-    fi
-done
-
 # Copy cron scripts to the appropriate destinations
 
 cd /var/www/code