diff --git a/system/monitoring/logs.nix b/system/monitoring/logs.nix
index d3fad59..6a21a62 100644
--- a/system/monitoring/logs.nix
+++ b/system/monitoring/logs.nix
@@ -21,6 +21,8 @@ in
   vault.secrets.promtail-loki-auth = lib.mkIf config.vault.enable {
     secretPath = "shared/loki/push-auth";
     extractKey = "password";
+    owner = "promtail";
+    group = "promtail";
     services = [ "promtail" ];
   };