diff --git a/amanuensis.nix b/amanuensis.nix
index c94236f..1b44eeb 100644
--- a/amanuensis.nix
+++ b/amanuensis.nix
@@ -13,9 +13,11 @@ in
   # Create a user for the server process to run under
   users.users.amanuensis = {
     isNormalUser = true;
+    group = "amanuensis";
     description = "Amanuensis server user";
     packages = [ python3-with-amanuensis-requires ];
   };
+  users.groups.amanuensis = {};
 
   # Create the server process systemd unit
   systemd.services.amanuensis = {
diff --git a/configuration.nix b/configuration.nix
index 9eee6e8..67a2d37 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -23,6 +23,8 @@
   };
   boot.kernelParams = ["console=ttyS0"];
 
+  nix.package = pkgs.nixFlakes;
+
   networking.hostName = "empyrean";
 
   # The global useDHCP flag is deprecated, therefore explicitly set to false here.
@@ -115,8 +117,10 @@
 
   users.users.tvb = {
     isNormalUser = true;
+    group = "tvb";
     extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
   };
+  users.groups.tvb = {};
 
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions
diff --git a/redstring.nix b/redstring.nix
index ec5ec04..15ae0a0 100644
--- a/redstring.nix
+++ b/redstring.nix
@@ -18,6 +18,7 @@ let
   redstringUser = {
     name = "redstring";
     description = "redstring service user";
+    group = "redstring";
     isSystemUser = true;
   };
 
@@ -71,6 +72,7 @@ let
 in
 {
   users.users.redstring = redstringUser;
+  users.groups.redstring = {};
 
   # Run the setup script on activation
   system.activationScripts.redstringSetup = "${redstringSetup}/bin/redstring-setup.sh";