diff --git a/nix-system-configs/modules/system/mail-server.nix b/nix-system-configs/modules/system/mail-server.nix
index 60820e3..ab584d2 100644
--- a/nix-system-configs/modules/system/mail-server.nix
+++ b/nix-system-configs/modules/system/mail-server.nix
@@ -53,16 +53,16 @@ in {
     environment.etc = {
       "stalwart/mail-pw1".text = boardPassword; # principal password (board)
       "stalwart/mail-pw1".mode = "0440";
-      "stalwart/mail-pw1".owner = "stalwart";
+      "stalwart/mail-pw1".user = "stalwart";
       "stalwart/admin-pw".text = adminPassword; # admin fallback password
       "stalwart/admin-pw".mode = "0440";
-      "stalwart/admin-pw".owner = "root";
+      "stalwart/admin-pw".user = "stalwart";
       "stalwart/acme-secret".text = cloudflareToken; # API token for ACME (Cloudflare)
       "stalwart/acme-secret".mode = "0440";
-      "stalwart/acme-secret".owner = "stalwart";
+      "stalwart/acme-secret".user = "stalwart";
       "stalwart/cloudflare-username".text = cloudflareUsername; # contact email for ACME
       "stalwart/cloudflare-username".mode = "0440";
-      "stalwart/cloudflare-username".owner = "stalwart";
+      "stalwart/cloudflare-username".user = "stalwart";
     };
 
     # Enable Tailscale for remote access to Traefik dashboard and configuration