diff --git a/.gitignore b/.gitignore
index 56a01c7..40bf02b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 .env
 .direnv
 .claude
+/result
diff --git a/hosts/hyd-eu-1/services/hydrant.nix b/hosts/hyd-eu-1/services/hydrant.nix
index 8849650..190f4cf 100644
--- a/hosts/hyd-eu-1/services/hydrant.nix
+++ b/hosts/hyd-eu-1/services/hydrant.nix
@@ -31,6 +31,12 @@
     cargoBuildFeatures = ["jetstream"];
   };
 in {
+  users.groups.hydrant = {};
+  users.users.hydrant = {
+    isSystemUser = true;
+    group = "hydrant";
+  };
+
   systemd.services.hydrant = {
     description = "tangled atproto indexer and jetstream service";
     wantedBy = ["multi-user.target"];
@@ -74,7 +80,8 @@ in {
       ExecStart = "${hydrant}/bin/hydrant";
       Restart = "on-failure";
       RestartSec = "10s";
-      DynamicUser = true;
+      User = "hydrant";
+      Group = "hydrant";
       StateDirectory = "hydrant";
       StateDirectoryMode = "0750";
       WorkingDirectory = "/var/lib/hydrant";