diff --git a/security.nix b/security.nix
index 9448c06..4376102 100644
--- a/security.nix
+++ b/security.nix
@@ -52,10 +52,12 @@ in {
 
   users.users.out-of-tree = {
     home = "/var/out-of-tree";
+    group = "out-of-tree";
     isSystemUser = true;
     createHome = true;
     extraGroups = [ "docker" "kvm" ];
   };
+  users.groups.out-of-tree = {};
 
   environment.systemPackages = with pkgs; [
     (writeShellScriptBin "fhs" "sudo ${fhs}/bin/fhs")