diff --git a/flake.nix b/flake.nix
index b95091d..bbea3bc 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,6 +1,6 @@
 # flake for blakes nixos config
 # define new devices in outputs
-# generation: 39 current  2025-10-06 13:45:56  25.05.20251001.5b5be50  6.12.49                          *
+# generation: 40 current  2025-10-06 14:01:16  25.05.20251001.5b5be50  6.12.49                          *
 {
   description = "blakes nix config";
   inputs = {
diff --git a/modules/homelab/services/jellyfin/default.nix b/modules/homelab/services/jellyfin/default.nix
index 1339741..01e50ae 100644
--- a/modules/homelab/services/jellyfin/default.nix
+++ b/modules/homelab/services/jellyfin/default.nix
@@ -26,16 +26,19 @@ in
       isSystemUser = true;
       home = "/var/lib/jellyfin";
       createHome = true;
-      group = "media";
-      extraGroups = [ "video" "render" ];
+      group = "jellyfin";
+      extraGroups = [ "media" "video" "render" ];
     };
 
     services.jellyfin = {
       enable = true;
       openFirewall = true;        # Opens 8096/8920 automatically
       user = "jellyfin";          # Default: jellyfin
-      group = "media";         # Default: jellyfin
+      group = "jellyfin";         # Default: jellyfin
       dataDir = "/var/lib/jellyfin"; # Config + metadata storage
     };
+    systemd.services.jellyfin.serviceConfig = {
+      UMask = lib.mkForce "0007";
+    };
   };
 }