diff --git a/playbooks/roles/bifrost-ironic-install/tasks/bootstrap.yml b/playbooks/roles/bifrost-ironic-install/tasks/bootstrap.yml
index c815ba055..a91886e56 100644
--- a/playbooks/roles/bifrost-ironic-install/tasks/bootstrap.yml
+++ b/playbooks/roles/bifrost-ironic-install/tasks/bootstrap.yml
@@ -224,7 +224,7 @@
     state: directory
     mode: 0750
     owner: "ironic"
-    group: "ironic"
+    group: "{{ nginx_user }}"
   loop:
     - "/var/lib/ironic"
     - "/var/lib/ironic/master_images"
diff --git a/releasenotes/notes/images-permissions-2042490e3ca13656.yaml b/releasenotes/notes/images-permissions-2042490e3ca13656.yaml
new file mode 100644
index 000000000..ef4051e6c
--- /dev/null
+++ b/releasenotes/notes/images-permissions-2042490e3ca13656.yaml
@@ -0,0 +1,5 @@
+---
+fixes:
+  - |
+    Makes ``/var/lib/ironic`` and its images subdirectories readable by nginx.
+    This is required for using the images cache.