diff --git a/nixos/server/package-configs/firefox-sync/default.nix b/nixos/server/package-configs/firefox-sync/default.nix
index 060f02f..2566296 100644
--- a/nixos/server/package-configs/firefox-sync/default.nix
+++ b/nixos/server/package-configs/firefox-sync/default.nix
@@ -6,7 +6,9 @@
   port = 5126;
 in {
   sops.secrets."sync-secrets".mode = "0440";
-  sops.secrets."sync-secrets".owner = config.users.users."firefox-syncserver".name;
+  sops.secrets."sync-secrets".owner = config.users.users.firefox-syncserver.name;
+
+  users.users.firefox-syncserver.extraGroups = [config.users.groups.keys.name];
 
   services.mysql.package = pkgs.mariadb;
   services.firefox-syncserver = {