diff --git a/modules/adguard.nix b/modules/adguard.nix
index cab559f..4a2b2fb 100644
--- a/modules/adguard.nix
+++ b/modules/adguard.nix
@@ -139,7 +139,7 @@ in
     systemd.services.adguardhome = {
       requires = [ "acme-${cfg.domain}.service" ];
       after = [ "acme-${cfg.domain}.service" ];
-      serviceConfig.SupplementaryGroups = [ "acme" ];
+      serviceConfig.SupplementaryGroups = [ "acme" "keys" ];
       serviceConfig.SystemCallFilter = lib.mkForce [];
       preStart = lib.mkAfter ''
         if [ -f /var/lib/private/AdGuardHome/AdGuardHome.yaml ]; then