diff --git a/modules/tv/git/cgit.nix b/modules/tv/git/cgit.nix
index a3b72bf8e..747a93135 100644
--- a/modules/tv/git/cgit.nix
+++ b/modules/tv/git/cgit.nix
@@ -39,7 +39,7 @@ in
 
     virtual-root=/cgit
 
-    # TODO make this nicer
+    # TODO make this nicer (and/or somewhere else)
     cache-root=/tmp/cgit
 
     cache-size=1000
@@ -64,6 +64,11 @@ in
     '') (filter isPublicRepo (attrValues cfg.repos))}
   '';
 
+  system.activationScripts.cgit = ''
+    mkdir -m 0700 -p /tmp/cgit
+    chown fcgiwrap: /tmp/cgit
+  '';
+
   tv.nginx = {
     enable = true;
     retiolum-locations = [