diff --git a/hw/straylight/default.nix b/hw/straylight/default.nix
index e9ca2c6..af8b97a 100644
--- a/hw/straylight/default.nix
+++ b/hw/straylight/default.nix
@@ -17,6 +17,8 @@
     services.ollama = {
       enable = true;
       acceleration = "vulkan";
+      user = "ollama";
+      group = "ollama";
     };
     # straylight is the unikernel host. The shared mcp.nix locks the agent
     # down with PrivateDevices=true, which hides /dev/kvm and /dev/net/tun.