diff --git a/modules/cloonar-assistant/updns/default.nix b/modules/cloonar-assistant/updns/default.nix
index 8ea1bb4..d23c356 100644
--- a/modules/cloonar-assistant/updns/default.nix
+++ b/modules/cloonar-assistant/updns/default.nix
@@ -5,6 +5,12 @@
     jq
   ];
 
+  users.users.updns-client = {
+    isSystemUser = true;
+    group = "updns-client";
+  };
+  users.groups.updns-client = { };
+
   sops.secrets.updns-client = {
     owner = "updns-client";
     restartUnits = [ "updns-client.service" ];
@@ -63,6 +69,7 @@
 
   ### 5) Define the oneshot service
   systemd.services.updns-client = lib.mkIf config.cloonar-assistant.updns-client.enable {
+    user        = "updns-client";
     description = "Check external IP and notify API on change";
     after       = [ "network-online.target" ];
     wants       = [ "network-online.target" ];