diff --git a/dist/debian/arsse.links b/dist/debian/arsse.links
new file mode 100644
index 00000000..15663aad
--- /dev/null
+++ b/dist/debian/arsse.links
@@ -0,0 +1 @@
+etc/arsse/config.php usr/share/arsse/config.php
\ No newline at end of file
diff --git a/dist/debian/arsse.postinst b/dist/debian/arsse.postinst
index 4b3bf172..90d4633f 100644
--- a/dist/debian/arsse.postinst
+++ b/dist/debian/arsse.postinst
@@ -4,17 +4,21 @@ set -e
 
 . /usr/share/debconf/confmodule
 
-# Set up dbconfig-common
-if test -f /usr/share/dbconfig-common/dpkg/postinst; then
-    . /usr/share/dbconfig-common/dpkg/postinst
-    dbc_generate_include_owner="root:www-data"
-    dbc_generate_include_perms="0640"
-    dbc_generate_include="php:/var/lib/arsse/dbconfig.inc"
-    dbc_pgsql_createdb_encoding="UTF8' lc_collate='C"
-    dbc_mysql_createdb_encoding="UTF8"
-    dbc_dbfile_owner="root:www-data"
-    dbc_dbfile_perms="0660"
-    dbc_go arsse "$@"
+if [ "$1" = "configure" ]; then
+    # Set permissions on configuration file
+    dpkg-statoverride --list "/etc/arsse/config.php" >/dev/null || dpkg-statoverride --update --add root www-data 640 "/etc/arsse/config.php"
+    # Set up dbconfig-common
+    if test -f /usr/share/dbconfig-common/dpkg/postinst; then
+        . /usr/share/dbconfig-common/dpkg/postinst
+        dbc_generate_include_owner="root:www-data"
+        dbc_generate_include_perms="0640"
+        dbc_generate_include="php:/var/lib/arsse/dbconfig.inc"
+        dbc_pgsql_createdb_encoding="UTF8' lc_collate='C"
+        dbc_mysql_createdb_encoding="UTF8"
+        dbc_dbfile_owner="root:www-data"
+        dbc_dbfile_perms="0660"
+        dbc_go arsse "$@"
+    fi
 fi
 
 # dh_installdeb will replace this with shell code automatically