diff --git a/krebs/3modules/tinc_graphs.nix b/krebs/3modules/tinc_graphs.nix
index 7a414e6e3..733db69ca 100644
--- a/krebs/3modules/tinc_graphs.nix
+++ b/krebs/3modules/tinc_graphs.nix
@@ -128,9 +128,12 @@ let
 
     users.extraUsers.tinc_graphs = {
       uid = genid_uint31 "tinc_graphs";
+      group = "tinc_graphs";
       home = "/var/spool/tinc_graphs";
       isSystemUser = true;
     };
+    users.groups.tinc_graphs = {};
+
     services.nginx = mkIf cfg.nginx.enable {
       enable = mkDefault true;
       virtualHosts = {