diff --git a/configs/radio/default.nix b/configs/radio/default.nix
index 967028a..d597f57 100644
--- a/configs/radio/default.nix
+++ b/configs/radio/default.nix
@@ -63,7 +63,11 @@ in
     })
   ];
 
-  users.extraUsers.radio.isSystemUser = true;
+  users.extraUsers.radio = {
+    isSystemUser = true;
+    group = "radio";
+  };
+  users.groups.radio = {};
 
   krebs.htgen.radio = {
     port = htgenPort;
diff --git a/configs/urlwatch.nix b/configs/urlwatch.nix
index 0c06b46..b14ba68 100644
--- a/configs/urlwatch.nix
+++ b/configs/urlwatch.nix
@@ -128,8 +128,11 @@ in
     home = urlwatchDir;
     createHome = true;
     isSystemUser = true;
+    group = "urlwatch";
   };
 
+  users.groups.urlwatch = {};
+
   systemd.services.urlwatch = {
     enable = true;
     startAt = "*-*-* 05:00:00";
@@ -140,6 +143,7 @@ in
     '';
     serviceConfig = {
       User = config.users.extraUsers.urlwatch.name;
+      Group = config.users.groups.urlwatch.name;
       WorkingDirectory = config.users.extraUsers.urlwatch.home;
       PermissionsStartOnly = "true";
       PrivateTmp = "true";