diff --git a/machines/prattle/default.nix b/machines/prattle/default.nix
index 1eb09c4..36ac165 100644
--- a/machines/prattle/default.nix
+++ b/machines/prattle/default.nix
@@ -142,6 +142,14 @@
   programs.zsh.enable = true;
   programs.direnv.enable = true;
 
+  users.groups.garage = { };
+  users.users.garage = {
+    isSystemUser = true;
+    group = "garage";
+    home = "/var/lib/garage";
+    createHome = false;
+  };
+
   users.users = {
     kierank = {
       initialPassword = "changeme";
@@ -502,6 +510,13 @@
     };
   };
 
+  # Custom paths need a static user; disable DynamicUser so tmpfiles ownership works
+  systemd.services.garage.serviceConfig = {
+    DynamicUser = lib.mkForce false;
+    User = "garage";
+    Group = "garage";
+  };
+
   # Bootstrap garage: generate RPC secret, assign layout, create default key/bucket
   systemd.services.garage-bootstrap = {
     description = "Bootstrap Garage cluster (one-time setup)";