diff --git a/lass/1systems/prism.nix b/lass/1systems/prism.nix
index 1bc8d5744..9da261ed4 100644
--- a/lass/1systems/prism.nix
+++ b/lass/1systems/prism.nix
@@ -188,9 +188,16 @@ in {
             "fullchain.pem"
             "full.pem"
           ];
-          user = "ejabberd";
+          allowKeysForGroup = true;
+          group = "lasscert";
         };
       };
+      users.groups.lasscert.members = [
+        "dovecot2"
+        "ejabberd"
+        "exim"
+        "nginx"
+      ];
       krebs.nginx.servers."lassul.us" = {
         server-names = [ "lassul.us" ];
         locations = [