diff --git a/modules/hermes/hermes.nix b/modules/hermes/hermes.nix
index 40828a3..ccd5a6f 100644
--- a/modules/hermes/hermes.nix
+++ b/modules/hermes/hermes.nix
@@ -2,7 +2,6 @@
   inputs,
   config,
   pkgs,
-  username,
   ...
 }:
 
@@ -81,18 +80,39 @@
     8642
   ];
 
-  systemd.services.hermes-dashboard = {
-    description = "Hermes Agent Web Dashboard";
-    after = [ "hermes-agent.service" ];
-    bindsTo = [ "hermes-agent.service" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      Type = "simple";
-      ExecStart = "${pkgs.docker}/bin/docker exec -u hermes hermes-agent /data/current-package/bin/hermes dashboard --host 0.0.0.0 --port 9119 --no-open";
-      Restart = "on-failure";
-      RestartSec = 5;
-      StartLimitIntervalSec = 60;
-      StartLimitBurst = 3;
+  systemd = {
+    paths.hermes-perms-watch = {
+      description = "Watch hermes data dir for permission changes";
+      wantedBy = [ "multi-user.target" ];
+      pathConfig = {
+        PathChanged = "/var/lib/hermes/.hermes";
+        Unit = "hermes-perms-fix.service";
+      };
+    };
+
+    services = {
+      hermes-dashboard = {
+        description = "Hermes Agent Web Dashboard";
+        after = [ "hermes-agent.service" ];
+        bindsTo = [ "hermes-agent.service" ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          Type = "simple";
+          ExecStart = "${pkgs.docker}/bin/docker exec -u hermes hermes-agent /data/current-package/bin/hermes dashboard --host 0.0.0.0 --port 9119 --no-open";
+          Restart = "on-failure";
+          RestartSec = 5;
+          StartLimitIntervalSec = 60;
+          StartLimitBurst = 3;
+        };
+      };
+
+      hermes-perms-fix = {
+        description = "Fix hermes data dir permissions";
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = "${pkgs.coreutils}/bin/chmod 770 -R /var/lib/hermes/.hermes";
+        };
+      };
     };
   };
 }