diff --git a/services/kanidm/default.nix b/services/kanidm/default.nix
index 8d15bd5..ad45c39 100644
--- a/services/kanidm/default.nix
+++ b/services/kanidm/default.nix
@@ -49,6 +49,8 @@
     secretPath = "kanidm/idm-admin-password";
     extractKey = "password";
     services = [ "kanidm" ];
+    owner = "kanidm";
+    group = "kanidm";
   };
 
   # Monitoring scrape target