diff --git a/modules/system/authentik.nix b/modules/system/authentik.nix
index 901f7cc..6444815 100644
--- a/modules/system/authentik.nix
+++ b/modules/system/authentik.nix
@@ -22,6 +22,11 @@ with lib;
 				    -p 127.0.0.1:10000:9000
 			'';
 		};
+		systemd.tmpfiles.rules = [
+			"d /opt/authentik/certs 0755 authentik authentik"
+			"d /opt/authentik/media 0755 authentik authentik"
+			"d /opt/authentik/templates 0755 authentik authentik"
+		];
 		users.groups.authentik = {};
 		users.users.authentik = {
 			group = "authentik";