diff --git a/applications/grafana.nix b/applications/grafana.nix
index 6d27d40..a1c67b7 100644
--- a/applications/grafana.nix
+++ b/applications/grafana.nix
@@ -49,7 +49,11 @@ in {
       "${name}.skynet.ie"
     ];
 
-    age.secrets.grafana_pw.file = ../secrets/grafana/pw.age;
+    age.secrets.grafana_pw = {
+      file = ../secrets/grafana/pw.age;
+      owner = "grafana";
+      group = "grafana";
+    };
 
     services.grafana = {
       enable = true;