diff --git a/ops/nixos/bvm-radius/default.nix b/ops/nixos/bvm-radius/default.nix
index e8de9a61b3..17c3f65f03 100644
--- a/ops/nixos/bvm-radius/default.nix
+++ b/ops/nixos/bvm-radius/default.nix
@@ -2,7 +2,7 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-{ config, depot, pkgs, ... }:
+{ config, depot, lib, pkgs, ... }:
 let
   inherit (depot.ops) secrets;
 in {
@@ -64,6 +64,7 @@ in {
       '';
     };
   };
+  users.users.nginx.extraGroups = lib.mkAfter [ "acme" ];
 
   system.stateVersion = "21.05";
 }