diff --git a/hosts/lala/tangled.nix b/hosts/lala/tangled.nix
index b05a28b..2df8bde 100644
--- a/hosts/lala/tangled.nix
+++ b/hosts/lala/tangled.nix
@@ -25,6 +25,10 @@ in
       ];
     };
   };
+  services.openssh.settings = {
+    AllowUsers = [ config.services.tangled.knot.gitUser ];
+    AllowGroups = [ config.services.tangled.knot.gitUser ];
+  };
   services.tangled.knot = {
     enable = true;
     server = {