diff --git a/plugins/plugin/install b/plugins/plugin/install
new file mode 100755
index 000000000..cb3c81022
--- /dev/null
+++ b/plugins/plugin/install
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+source "$PLUGIN_AVAILABLE_PATH/plugin/internal-functions"
+
+trigger-plugin-install() {
+  declare desc="plugin install plugin trigger"
+  declare trigger="install"
+
+  fn-plugin-set-permissions
+}
+
+trigger-plugin-install "$@"
diff --git a/plugins/plugin/internal-functions b/plugins/plugin/internal-functions
index c0be708a6..67098e819 100755
--- a/plugins/plugin/internal-functions
+++ b/plugins/plugin/internal-functions
@@ -21,6 +21,12 @@ cmd-plugin-installed() {
   plugn list | awk '{print $1}' | grep -q "^${PLUGIN_NAME}$"
 }
 
+fn-plugin-set-permissions() {
+  declare desc="ensures correct permissions for all available plugins"
+  chown -R "${DOKKU_SYSTEM_USER}:${DOKKU_SYSTEM_GROUP}" "$PLUGIN_CORE_AVAILABLE_PATH" "$PLUGIN_AVAILABLE_PATH"
+  chown -R "${DOKKU_SYSTEM_USER}:${DOKKU_SYSTEM_GROUP}" "$PLUGIN_CORE_ENABLED_PATH" "$PLUGIN_ENABLED_PATH"
+}
+
 plugin_prime_bash_completion() {
   declare desc="primes the bash-completion cache"
 
diff --git a/plugins/plugin/update b/plugins/plugin/update
new file mode 100755
index 000000000..0455eaa14
--- /dev/null
+++ b/plugins/plugin/update
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+source "$PLUGIN_AVAILABLE_PATH/plugin/internal-functions"
+
+trigger-plugin-update() {
+  declare desc="plugin update plugin trigger"
+  declare trigger="update"
+
+  fn-plugin-set-permissions
+}
+
+trigger-plugin-update "$@"
diff --git a/tests/unit/plugin.bats b/tests/unit/plugin.bats
index 2cbe1b4b8..25f226dfb 100644
--- a/tests/unit/plugin.bats
+++ b/tests/unit/plugin.bats
@@ -180,3 +180,69 @@ teardown() {
   echo "status: $status"
   assert_failure
 }
+
+@test "(plugin) plugin:install permissions set properly" {
+  run /bin/bash -c "ls -lah /var/lib/dokku/core-plugins/available/git/commands"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "root" "0"
+  assert_output_contains "dokku" "3"
+
+  run /bin/bash -c "chown -R root:root /var/lib/dokku/core-plugins/available/git"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "ls -lah /var/lib/dokku/core-plugins/available/git/commands"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "root" "2"
+  assert_output_contains "dokku" "1"
+
+  run /bin/bash -c "dokku plugin:install"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "ls -lah /var/lib/dokku/core-plugins/available/git/commands"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "root" "0"
+  assert_output_contains "dokku" "3"
+}
+
+@test "(plugin) plugin:update permissions set properly" {
+  run /bin/bash -c "ls -lah /var/lib/dokku/core-plugins/available/git/commands"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "root" "0"
+  assert_output_contains "dokku" "3"
+
+  run /bin/bash -c "chown -R root:root /var/lib/dokku/core-plugins/available/git"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "ls -lah /var/lib/dokku/core-plugins/available/git/commands"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "root" "2"
+  assert_output_contains "dokku" "1"
+
+  run /bin/bash -c "dokku plugin:update"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "ls -lah /var/lib/dokku/core-plugins/available/git/commands"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "root" "0"
+  assert_output_contains "dokku" "3"
+}