diff --git a/deploy_nixos/unpack-keys.sh b/deploy_nixos/unpack-keys.sh
index 37db350..82ead0b 100644
--- a/deploy_nixos/unpack-keys.sh
+++ b/deploy_nixos/unpack-keys.sh
@@ -40,6 +40,7 @@ for keyname in $(jq -S -r 'keys[]' "$keys_file"); do
   echo "unpacking: $keyname"
   jq -r ".\"$keyname\"" < "$keys_file" > "$keys_dir/$keyname"
   chmod 0640 "$keys_dir/$keyname"
+  chown root:keys "$keys_dir/$keyname"
 done
 
 echo "unpacking done"