diff --git a/lass/1systems/mors/config.nix b/lass/1systems/mors/config.nix
index 7e183f40f..f911b79d6 100644
--- a/lass/1systems/mors/config.nix
+++ b/lass/1systems/mors/config.nix
@@ -49,12 +49,15 @@ with import <stockholm/lib>;
       ];
     }
     {
-      krebs.syncthing.folders = [
-        { id = "the_playlist"; path = "/home/lass/tmp/the_playlist"; peers = [ "mors" "phone" "prism" ]; }
-      ];
-      lass.ensure-permissions = [
-        { folder = "/home/lass/tmp/the_playlist"; owner = "lass"; group = "syncthing"; }
-      ];
+      krebs.syncthing.folders."the_playlist" = {
+        path = "/home/lass/tmp/the_playlist";
+        peers = [ "mors" "phone" "prism" ];
+      };
+      krebs.permown."/home/lass/tmp/the_playlist" = {
+        owner = "lass";
+        group = "syncthing";
+        umask = "0007";
+      };
     }
     {
       lass.umts = {
diff --git a/lass/2configs/green-host.nix b/lass/2configs/green-host.nix
index 860d7c113..1421eede7 100644
--- a/lass/2configs/green-host.nix
+++ b/lass/2configs/green-host.nix
@@ -20,13 +20,12 @@ with import <stockholm/lib>;
     }
   ];
 
-  lass.ensure-permissions = [
-    { folder = "/var/lib/sync-containers"; owner = "root"; group = "syncthing"; }
-  ];
-
-  krebs.syncthing.folders = [
-    { path = "/var/lib/sync-containers"; peers = [ "icarus" "skynet" "littleT" "shodan" ]; }
-  ];
+  krebs.syncthing.folders."/var/lib/sync-containers".peers = [ "icarus" "skynet" "littleT" "shodan" ];
+  krebs.permown."/var/lib/sync-containers" = {
+    owner = "root";
+    group = "syncthing";
+    umask = "0007";
+  };
 
   system.activationScripts.containerPermissions = ''
     mkdir -p /var/lib/containers
diff --git a/lass/2configs/radio.nix b/lass/2configs/radio.nix
index d67d970f8..521b3c050 100644
--- a/lass/2configs/radio.nix
+++ b/lass/2configs/radio.nix
@@ -248,10 +248,13 @@ in {
       alias ${html};
     '';
   };
-  krebs.syncthing.folders = [
-    { id = "the_playlist"; path = "/home/radio/music/the_playlist"; peers = [ "mors" "phone" "prism" ]; }
-  ];
-  lass.ensure-permissions = [
-    { folder = "/home/radio/music/the_playlist"; owner = "radio"; group = "syncthing"; }
-  ];
+  krebs.syncthing.folders."the_playlist" = {
+    path = "/home/radio/music/the_playlist";
+    peers = [ "mors" "phone" "prism" ];
+  };
+  krebs.permown."/home/radio/music/the_playlist" = {
+    owner = "radio";
+    group = "syncthing";
+    umask = "0007";
+  };
 }
diff --git a/lass/2configs/sync/decsync.nix b/lass/2configs/sync/decsync.nix
index 94569c94d..c3f6511c2 100644
--- a/lass/2configs/sync/decsync.nix
+++ b/lass/2configs/sync/decsync.nix
@@ -1,8 +1,11 @@
 {
-  krebs.syncthing.folders = [
-    { id = "decsync"; path = "/home/lass/decsync"; peers = [ "mors" "blue" "green" "phone" ]; }
-  ];
-  lass.ensure-permissions = [
-    { folder = "/home/lass/decsync"; owner = "lass"; group = "syncthing"; }
-  ];
+  krebs.syncthing.folders.decsync = {
+    path = "/home/lass/decsync";
+    peers = [ "mors" "blue" "green" "phone" ];
+  };
+  krebs.permown."/home/lass/decsync" = {
+    owner = "lass";
+    group = "syncthing";
+    umask = "0007";
+  };
 }
diff --git a/lass/2configs/sync/weechat.nix b/lass/2configs/sync/weechat.nix
index d10177b1d..30c7b262b 100644
--- a/lass/2configs/sync/weechat.nix
+++ b/lass/2configs/sync/weechat.nix
@@ -1,8 +1,8 @@
 {
-  krebs.syncthing.folders = [
-    { path = "/home/lass/.weechat"; peers = [ "blue" "green" "mors" ]; }
-  ];
-  lass.ensure-permissions = [
-    { folder = "/home/lass/.weechat"; owner = "lass"; group = "syncthing"; }
-  ];
+  krebs.syncthing.folders."/home/lass/.weechat".peers = [ "blue" "green" "mors" ];
+  krebs.permown."/home/lass/.weechat" = {
+    owner = "lass";
+    group = "syncthing";
+    umask = "0007";
+  };
 }
diff --git a/lass/2configs/syncthing.nix b/lass/2configs/syncthing.nix
index fc10b2cb4..48f2625c1 100644
--- a/lass/2configs/syncthing.nix
+++ b/lass/2configs/syncthing.nix
@@ -1,6 +1,6 @@
-{ config, pkgs, ... }:
-with import <stockholm/lib>;
-{
+{ config, pkgs, ... }: with import <stockholm/lib>; let
+  peers = mapAttrs (n: v: { id = v.syncthing.id; }) (filterAttrs (n: v: v.syncthing.id != null) config.krebs.hosts);
+in {
   services.syncthing = {
     enable = true;
     group = "syncthing";
@@ -14,17 +14,17 @@ with import <stockholm/lib>;
     enable = true;
     cert = toString <secrets/syncthing.cert>;
     key = toString <secrets/syncthing.key>;
-    peers = mapAttrs (n: v: { id = v.syncthing.id; }) (filterAttrs (n: v: v.syncthing.id != null) config.krebs.hosts);
-    folders = [
-      { path = "/home/lass/sync"; peers = [ "icarus" "mors" "skynet" "blue" "green" "littleT" "prism" "shodan" ]; }
-    ];
+    peers = peers;
+    folders."/home/lass/sync".peers = attrNames peers;
   };
 
   system.activationScripts.syncthing-home = ''
     ${pkgs.coreutils}/bin/chmod a+x /home/lass
   '';
 
-  lass.ensure-permissions = [
-    { folder = "/home/lass/sync"; owner = "lass"; group = "syncthing"; }
-  ];
+  krebs.permown."/home/lass/sync" = {
+    owner = "lass";
+    group = "syncthing";
+    umask = "0007";
+  };
 }