diff --git a/hosts/modules/alexandria/services.nix b/hosts/modules/alexandria/services.nix
index ff81d85..f4f8acf 100644
--- a/hosts/modules/alexandria/services.nix
+++ b/hosts/modules/alexandria/services.nix
@@ -96,7 +96,7 @@ in
   age.secrets.cloudflare = {
     file = ../../../secrets/cloudflare.age;
     owner = "nginx";
-    group = "hosted";
+    group = "nginx";
   };
 
   # TODO: remove when bug fix