diff --git a/modules/nixos/nginx/default.nix b/modules/nixos/nginx/default.nix
index d28d7a9..3b2bef1 100644
--- a/modules/nixos/nginx/default.nix
+++ b/modules/nixos/nginx/default.nix
@@ -62,6 +62,7 @@ in
       acceptTerms = true;
       defaults.email = mkDefault "postmaster@${config.networking.domain}";
       defaults.webroot = mkDefault "/var/lib/acme/acme-challenge";
+      defaults.group = mkDefault "nginx";
     };
 
     security.dhparams = mkIf cfg.forceSSL {