diff --git a/modules/adguard.nix b/modules/adguard.nix
index 24b3a1a..d9b73a7 100644
--- a/modules/adguard.nix
+++ b/modules/adguard.nix
@@ -107,7 +107,7 @@ in
     systemd.services.adguardhome = {
       requires = [ "acme-${cfg.domain}.service" ];
       after = [ "acme-${cfg.domain}.service" ];
-      serviceConfig.SupplementaryGroups = [ "acme" ];
+      serviceConfig.SupplementaryGroups = [ "acme" "nginx" ];
     };
 
     # Open firewall for DoT