In WiX, update a windows service appSettings.json before starting services

I have a WiX project that installs a few Windows Services that are written in .NET 6. They each have an appSettings.json file in their directory in Program Files. During the install UI, I need to ask a question of the user and update the appSettings.json files with the answer to that question. Here's the tricky part:

1. I need to modify the files in Program Files (which requires elevated privs)
2. I need to modify them after they are copied but before the services are started
3. We don't want to require that the install be run as admin

We are open to the notion of locating the appSettings.json files in some other directory that the install will have write permission to, but I don't know where that would be. It shouldn't be user-specific, since these are services that run as System.

I have a CA that tries to modify the files, but it fails because I don't have write permission.

Here's what I've currently got for my CA (a C# DLL):

<CustomAction Id="UpdateConfigJson" Impersonate="yes" BinaryKey="MyCustomAction" DllEntry="UpdateConfigJson" Execute="deferred" Return="check"  />

<CustomAction Id="SetCADataProp" Property="UpdateConfigJson" Value="Arg1=[VALUE1];Arg2=[VALUE2]" />

    <InstallExecuteSequence>
        <Custom Action="SetCADataProp" Before="UpdateConfigJson"/>
        <Custom Action="UpdateConfigJson" Before="StartServices" />
    </InstallExecuteSequence>

The SetCADataProp CA allows for passing installer properties into my deferred CA.

The whole thing works except that I get the permission failure when trying to write to the files.

This question is more of a conceptual thing: Is there a known procedure for doing this (as this doesn't sound an uncommon need), or is the solution to put the files somewhere else?

Thank you!

If you want to write to an elevated location (like ProgramFilesFolder) then do not have your custom action impersonate the logged-in user, i.e. remove the CustomAction/@Impersonate='yes' attribute.