diff --git a/hosts/index/config/media/audiobookshelf.nix b/hosts/index/config/media/audiobookshelf.nix
index 6f61339..41a8e6f 100644
--- a/hosts/index/config/media/audiobookshelf.nix
+++ b/hosts/index/config/media/audiobookshelf.nix
@@ -1,4 +1,4 @@
-{ flakeRoot, ... }:
+{ flakeRoot, config, lib, ... }:
 
 let
   audiobookshelfModule = import (flakeRoot + /packages/server/media/audiobookshelf.nix) {
@@ -24,4 +24,6 @@ in
   services.audiobookshelf = {
     dataDir = "/mnt/apps/audiobookshelf";
   };
+
+  systemd.services.audiobookshelf.serviceConfig.WorkingDirectory = lib.mkForce config.services.audiobookshelf.dataDir;
 }
diff --git a/hosts/index/default.nix b/hosts/index/default.nix
index a212112..7d27b8a 100644
--- a/hosts/index/default.nix
+++ b/hosts/index/default.nix
@@ -29,7 +29,7 @@
     ./config/groupware/cells.nix
     ./config/groupware/maddy.nix
 
-    #./config/media/audiobookshelf.nix
+    ./config/media/audiobookshelf.nix
     #./config/media/emby.nix
     ./config/media/navidrome.nix
 
diff --git a/packages/server/media/audiobookshelf.nix b/packages/server/media/audiobookshelf.nix
index 1b2f655..41cd078 100644
--- a/packages/server/media/audiobookshelf.nix
+++ b/packages/server/media/audiobookshelf.nix
@@ -11,6 +11,14 @@
     host = "unix//run/audiobookshelf/audiobookshelf.sock";
   };
 
+  systemd.services.audiobookshelf.serviceConfig = {
+    RuntimeDirectory = "audiobookshelf";
+    RuntimeDirectoryMode = "0750";
+    UMask = "0007";
+  };
+
+  users.users.caddy.extraGroups = [ "audiobookshelf" ];
+
   services.caddy.virtualHosts = flakeLib.mkProxies hosts ''
     reverse_proxy ${config.services.audiobookshelf.host}
   '';